## caddyserver/caddy — v2.11.3…v2.11.4

_24 commits._

### Features
- **cmd: support caddy start on IPv6-only hosts (#7744)** (6628c4a)
- **caddyauth: add candidate placeholders for rejected identities (#7698)** (408d20a)

### Fixes
- **templates: Patch for GHSA-vcc4-2c75-vc9v (#7785)** (e2eee6a)
- **httpcaddyfile: fix incorrect error message on duplicate matchers (#7780)** (0e8eb41)
- **perf(replacer): optimize memory allocation for file placeholders (#7773)** (4d60d93)
- **reverseproxy: Add regression test for DialInfo network override (#7758)** (0b265eb)
- **caddytls: fix TLS state races and ECH rotation retry (#7756)** (325c244)
- **caddytls: Fix client auth (fix #7724) (#7727)** (6c675e2)

### Backend
- **Merge commit from fork** (3eb8e48)
- **encode: prioritize zstd and br over gzip in content negotiation (#7772)** (03e08ee)
- **caddytls: skip idna.ToASCII for pure ASCII SNI values (#7770)** (86121c8)
- **rewrite: prevent placeholder re-expansion in injected query (#7761)** (176b043)
- **Clarify policies for agents / LLM use** (4c04143)
- **go.mod: update x/net (#7767)** (94fcea0)
- **go.mod: Update x/crypto** (44b667a)
- **caddyhttp: normalize Windows backslashes in path matcher (#7763)** (217a785)
- **caddytls: match IDN SNI in connection policies (#7742)** (9505c0b)
- **reverseproxy: wraps request body to prevent closing if not read (#7719)** (ad91256)
- **caddyfile: preserve implicit TLS issuer semantics (#7743)** (6a210e9)
- **caddyhttp: omit Last-Modified for unusable mod times (#7740)** (0125ae3)
- **reverseproxy: further prevent body closes from dial errors (#7715)** (77e9ce7)

### Chore
- **build(deps): bump the all-updates group across 1 directory with 9 updates (#7752)** (b5898c3)
- **chore: clean up wording and typo fixes (#7745)** (88037f1)
- **chore: deps upgrade (#7751)** (704394d)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/caddyserver/caddy?utm_source=github-action)._