## caddyserver/caddy — v2.11.2…v2.11.3

_60 commits._

### Features
- **metrics: Add nil check for metricsHandler in AdminMetrics.serveHTTP (#7553)** (d80774c)
- **tls: add alpn to managed HTTPS records (#7653)** (5e76b5e)
- **reverseproxy: Add ability to clear dynamic upstreams cache during retries (#7662)** (4d69457)
- **caddyhttp: prefer port 443 in auto-HTTPS and add tests (#7666)** (441d5eb)
- **reverseproxy: add `lb_retry_match` condition on response status (#7569)** (aed1af5)
- **logging: add journald encoder wrapper (#7623)** (5f44ea0)
- **vars: Add matcher placeholder handling tests (#7640)** (7dcc041)
- **tls: add `system` and `combined` CA pool modules (#7406)** (d783467)
- **root: introduce down-propagating Helper.BlockState for other directives/plugins to use (#7594)** (62e9c05)
- **Add missing return to` handleError` in admin server** (c35ba55)

### Fixes
- **fastcgi: Fix lint** (9c78b97)
- **logging: add regression coverage for rotated file mode (#7620)** (fdbef2a)
- **Typo fix in security policy** (cf42f61)
- **fix(caddyfile): {block} in snippet (#7558)** (7dedd14)
- **reverseproxy: Fix check for `header_up Host {upstream_hostport}` redundancy (#7564)** (ea4ee3a)
- **caddytls: Ensure key list always gets set (fix #7555)** (8499e34)
- **Fix lint errors** (1fbb287)

### Backend
- **go.mod: Upgrade quic-go to v0.59.1** (cc58caa)
- **rewrite: escape file matcher paths before rewriting (#7683)** (a4a38c3)
- **templates: Explicitly warn about misconfigurations** (761347a)
- **caddytls: avoid duplicate automation for wildcard-covered hosts (#7697)** (0fab9f0)
- **Merge commit from fork** (fb32433)
- **httpcaddyfile: accept duration strings for log sampling interval (#7694)** (0780d44)
- **caddyauth: Revert "set user placeholders before auth rejection (#7685)" (#7688)** (c7c9f31)
- **caddyauth: set user placeholders before auth rejection (#7685)** (7e77eec)
- **caddytls: Expand ACME credentials (#7554)** (ef496e5)
- **admin: reject non-canonical config array indices (#7592)** (18ab0f9)
- **listeners: clean up stale Unix socket files on Windows (#7676)** (6a64bb2)
- **admin: require path segment boundary in remote access control (#7673)** (2d33271)
- **httpcaddyfile: inherit global ACME issuer settings in tls shortcuts (#7617)** (c1918ff)
- **metrics: Implement pushing via OLTP (#7664)** (2a3ed96)
- **go.mod: Upgrade dependencies including CertMagic** (f6ee80b)
- **admin: Limit config size (by @omercnet)** (48c08e3)
- **core: propagate ECH keys to the QUIC listener (#7670)** (41aee97)
- **admin: Redact sensitive request headers in API logs (#7578)** (4430756)
- **caddyhttp: Document missing placeholders for escaped URI and prefixed query (#7659)** (24bebd0)
- **fileserver: show symlink targets verbatim (#7579)** (7586e68)
- **logging: preserve ts for journald-wrapped JSON logs (#7644)** (0c7c91a)
- **caddyfile: Improve import/global options UX for imports before global options (#7642)** (8e2dd50)
- **reverseproxy: make stream copy buffer size configurable (#7627)** (ca0ca67)
- **vars: Don't expand placeholders in values (#7629)** (5de1565)
- **tls: expand placeholders in dns_challenge override_domain (#7609)** (4f50458)
- **notify: Always send "READY=1" even after an error (#7597)** (30b80be)
- **encode: make zstd checksum configurable (#7586)** (7a630f2)
- **rewrite: skip query rename when source key is absent (#7599)** (6f6771a)
- **caddytls: Consolidate empty APs more smartly (#7567)** (acf8d6a)
- **caddytls: Avoid default issuers for implicit tailscale policies (#7577)** (5d189af)
- **caddyhttp: Sync placeholder expansion in `vars` and `vars_regexp` (#7573)** (df65455)

### Docs
- **docs: add documentation for fileExists and fileStat template functions (#7700)** (4ba16fe)

### Chore
- **chore: Fix golangci-lint 2.12.1 findings (#7690)** (d2172be)
- **build(deps): bump github.com/jackc/pgx/v5 from 5.9.0 to 5.9.2 (#7668)** (c653e7d)
- **chore: Use atomics where appropriate (#7648)** (355c178)
- **build(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.0 (#7655)** (af89c5a)
- **chore: add `AGENTS.md` (#7652)** (bd9f145)
- **chore: bump timberjack to v1.4.1 (#7618)** (1a3e900)
- **chore: replace `interface{}` with `any` for modernization (#7571)** (0722cf6)
- **build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#7621)** (c8e4ac2)
- **build(deps): bump the all-updates group across 1 directory with 11 updates (#7641)** (92b6200)
- **build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (#7637)** (6c23ec2)
- **chore: Resolve recent CI failures (#7593)** (e98ed62)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/caddyserver/caddy?utm_source=github-action)._