## caddyserver/caddy — v2.11.0-beta.2…v2.11.0

_54 commits._

### Features
- **Revert "listeners: Add support for named socket activation (#7243)"** (6772ffb)
- **pki: add per-CA configurable `maintenance_interval` and `renewal_window_ratio` (#7479)** (affbb99)
- **caddyfile: Add `renewal_window_ratio` global option and `tls` subdirective (#7473)** (929d0e5)
- **caddyfile: add `observe_catchall_hosts` option (#7434)** (e40bd01)

### Fixes
- **fileserver: Fix tests on Windows** (cb436f0)
- **admin: Fix tests locally, properly isolate storage (#7486)** (3adcafd)
- **httpcaddyfile: Override global `dns` with `acme_dns` (fix #7294) (#7458)** (d6a6b48)
- **reverseproxy: fix X-Forwarded-* headers for Unix socket requests (#7463)** (03e6e43)
- **caddyhttp: Reject invalid Host header (fix #7449)** (7d24124)
- **caddyconfig: Fix indentation of multiline strings in fmt (#7425) (#7433)** (e9d290d)
- **reverseproxy: fix error when remote address is not an IP (#7429)** (62134d6)

### Backend
- **go.mod: Upgrade dependencies** (03243e4)
- **Merge commit from fork** (a108119)
- **Merge commit from fork** (eec32a0)
- **fileserver: Replace \ with \\ in file matcher paths** (a2825c5)
- **caddytest: make TestReverseProxyHealthCheck deterministic with poll instead of sleep (#7474)** (091add5)
- **encode: Implement Flush for legacy compatibility** (bdcdaf7)
- **caddytls: Enable debug logging for DNSManager (#7491)** (9fe694c)
- **dep: upgrade cel-go (#7478)** (23d07ac)
- **caddyhttp: Option to disable 0-RTT (#7485)** (d64c7e6)
- **caddytls: Finish removing prefer_wildcard** (6718bd4)
- **go.mod: update nebula v1.10.3 to resolve cve (#7471)** (80bf818)
- **caddytls: Return errors instead of nil in client auth provisioning (#7464)** (d42d39b)
- **acmeserver: warn when policy rules unset (#7469)** (0188ef2)
- **admin: Enforce origin implicitly based on request headers** (72ac479)
- **use math/rand/v2 instead of math/rand (#7413)** (47f3e8f)
- **Merge commit from fork** (7c28c0c)
- **Update SECURITY.md** (96f142c)
- **Update LLM disclosure requirements in SECURITY.md** (5ff5077)
- **caddyhttp: Use case-insensitive comparison for large Host lists** (1f43e85)
- **caddyhttp: Lowercase comparison when matching with escape sequence** (bd374ca)
- **reverseproxy: Set `Host` to `{upstream_hostport}` automatically if TLS (#7454)** (2ae0f7a)
- **Update detail in readme** (58968b3)
- **admin: Reject requests with Sec-Fetch-Mode headers** (42ca010)
- **Require disclosure of LLM usage in security reports** (40927d2)
- **caddytls: Check type assertion** (e0f8d9b)
- **reverseproxy: Customizable dial network for SRV upstreams** (3bb2267)
- **caddtls: Skip .ts.net domains for ECH (#6971)** (935b09d)
- **autohttps: deterministic logic and strict bind checking on Linux (#7435)** (565c1c3)
- **core: Show JSON error offsets where possible (#7437)** (d269405)
- **core: Embed `time/tzdata` (#7432)** (cbebc12)
- **update quic-go to v0.59.0 (#7431)** (5168acf)
- **Revise top of readme to include Warp sponsorship section** (28103aa)
- **headers: Make ApplyTo nil-safe (#7426)** (6a57142)
- **reverseproxy: make error chan bigger when reverse proxying websocket (#7419)** (80f2ae9)

### Chore
- **build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#7497)** (db256b5)
- **chore: Add nolints to work around haywire linters (#7493)** (95941a7)
- **chore: fix some comments to improve readability (#7395)** (b8b00d9)
- **refactor: use strings.Builder to improve performance (#7364)** (68d5002)
- **build(deps): bump the all-updates group across 1 directory with 12 updates (#7490)** (8a18acc)
- **chore: Remove obsolete comment in `ech.go` (#7487)** (ff4f79a)
- **chore: Bump zerossl dependency to 0.1.5 (#7489)** (f2213e9)
- **chore: bump Go to v1.26 (#7466)** (c0af7b6)
- **chore: Dumb `prealloc` lint fix (#7430)** (90972fb)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/caddyserver/caddy?utm_source=github-action)._