## caddyserver/caddy — v2.11.4…v2.11.5

_119 commits._

### Features
- **httpcaddyfile: new `tls_automate_names` global option (#8015)** (5ee9a2d)
- **logging: add set_cookie log filter for Set-Cookie response headers (#7888)** (50e54ee)
- **feat(fastcgi): populate SERVER_ADDR by default (#7912)** (546752e)
- **log: support `d` (day) in `roll_interval` directive (#7900)** (31daa22)
- **caddyhttp: add URL pattern request matcher (#7787)** (13a4c3f)
- **caddyhttp: New expected_underscore_headers server option (#7809)** (fcba554)
- **encode: add standard benchmark and conformance harness (#7804)** (997d3f6)
- **Add missing "is" (#7802)** (d3986f8)
- **caddyhttp: add {http.request.proto_name} placeholder for spec-compliant protocol names (#7782)** (915793f)

### Fixes
- **internal: fix `MaxSizeSubjectsListForLog` off-by-one when `maxToDisplay` is `0` (#7970)** (fbc88ae)
- **caddyhttp: fix randString sameCase dictionary to match its docs (#7972)** (5493791)
- **reverseproxy: Fix partial response not flushed to clients (#7849)** (89db4b7)
- **admin: fix warnings and status code in /load API (#7267)** (7e82a6b)
- **fix: require module path boundaries when matching packages (#7957)** (a75817f)
- **admin: fix host allow-list comparison to be case-insensitive (#7993)** (f7d5843)
- **caddyfile: fix importGraph self-loop and stale-edge bugs (#7971)** (2cb7ebc)
- **admin: fix origin allow-list host comparison to be case-insensitive (#7973)** (af29f9e)
- **core: fix ParseNetworkAddress port-range span off-by-one (#7975)** (62a7297)
- **rewrite: fix strip_path_suffix ignoring percent-encoding (#7877)** (7bf1b90)
- **rewrite: fix URI splitting when a query or fragment arrives via a placeholder (#7947)** (39af0ae)
- **fastcgi: fix HTTPoxy vulnerability (#7934)** (45ba327)
- **fix: close resources on error paths (#7940)** (0bbda5c)
- **caddyhttp: fix url_pattern authorization bypass via encoded-slash traversal (#7941)** (789f60e)
- **reverseproxy: fix broken reservoir sampling in random_choose policy (#7873)** (b2be548)
- **intercept: fix misleading handle_response error for extra matcher args (#7871)** (c1907df)
- **caddyhttp: fix path_regexp (MatchPathRE) Windows backslash bypass (#7858)** (c6180a0)
- **reverseproxy: fix misleading handle_response error for extra matcher args (#7869)** (945d199)
- **caddyhttp: fix escaped path matcher over-matching longer paths (#7828)** (08ad064)
- **tracing: fix BatchSpanProcessor goroutine leak on config reload (#7826)** (69d6ace)
- **intercept: fix replace_status being silently dropped (#7810)** (16235cc)
- **rewrite: fix wrong index check in trimPathPrefix (#7812)** (52dc670)

### Backend
- **caddyhttp: use errors.AsType for request body limit errors (#8090)** (0a137e2)
- **go.mod: Upgrade CertMagic, acmez, ZeroSSL, & some others** (90efc8f)
- **caddyhttp: wait for servers from previous configs on exit (#8009)** (ff112bb)
- **map: reject malformed destination placeholders (#8074)** (256df3c)
- **map: Distinguish duplicate literal and regexp inputs (#8067)** (ea1e94b)
- **caddyauth: only replace known placeholders in basic auth credentials (#8017)** (69ec5df)
- **requestbody: replace only known placeholders in the set body (#8008)** (81a0b6d)
- **caddyhttp: surface 413 for oversized request body placeholders (#7969)** (4845150)
- **reverseproxy: Move websocket header normalization later (#7921)** (7ee4441)
- **fastcgi: explain the 411 a body without a length gets (#7956)** (c798d4c)
- **reverse_proxy with versions 3 silently ignores tls_trust_pool and verifies against the system roots (#8042)** (c18099a)
- **core: synchronize Stop with concurrent config reloads (#8038)** (128b9e7)
- **caddyfile: Expand imports inside named routes (#7986)** (c1645c5)
- **reverseproxy: propagate TCP half-close on upgraded streams (#8027)** (9be8fb2)
- **Merge commit from fork** (ef18772)
- **caddyhttp: only replace known placeholders in respond headers (#8014)** (56e3a88)
- **acmeserver: say when the CA database is locked by another process (#8007)** (425a338)
- **reverseproxy: replace only known placeholders in health check body (#8003)** (56ae39b)
- **events: skip dispatch setup when nothing is subscribed (#7997)** (769ed7e)
- **caddyhttp: demote Alt-Svc ErrNoAltSvcPort to debug level (#8000)** (c8f0667)
- **listen: don't wedge a reloaded listener sharing a socket on Windows (#7999)** (e05f57d)
- **httpcaddyfile: give each adaptation its own directive order (#7995)** (9dd286c)
- **caddytls: synchronize storage cleaner with TLS.Stop via context and WaitGroup (#7954)** (8626fa3)
- **caddyhttp: surface write timeout errors in access log (#7945)** (8e90c9a)
- **fileserver: reject non-integer browse file_limit (#7988)** (97a08d8)
- **caddyhttp: remove unused QUICConfig from the HTTP/3 server (#7980)** (19be5d8)
- **cmd: make splitModule strictly conform to Go module spec (#7974)** (7cc98d4)
- **usagepool: avoid lock inversion after constructor failure (#7968)** (9968758)
- **cmd: upgrade automemlimit to v1.0.0 (#7978)** (d0e93c2)
- **admin: stabilise log redaction test (#7942)** (502691f)
- **fileserver: reject short names in every path component (#7952)** (3244ef4)
- **admin: normalize request path in remote admin access-control check (defense-in-depth) (#7910)** (d663793)
- **caddyfile: clarify ArgErr documentation (#7960)** (8b62e3c)
- **pki: honor skip_install_trust for explicit tls internal issuers (#7894)** (51db7f0)
- **caddyhttp: mitigate slowloris via idle read/write deadlines (#7913)** (0cf03d3)
- **reverseproxy: isolate active health-check state per distinct check config (#7916)** (6584c75)
- **caddyhttp: shield specific hostnames from a covering wildcard's client auth (#7920)** (1fed032)
- **Merge commit from fork** (d6f7f18)
- **Merge commit from fork** (947087c)
- **caddyhttp: allocate the request UUID lazily instead of on every request (#7936)** (63f4e38)
- **caddyhttp: log recovered handler panics at ERROR level (#7924)** (c290397)
- **network_proxy: reject proxy URLs that resolve to a port with no host (#7922)** (1880021)
- **reverseproxy: preallocate upstream slices with known sizes (#7926)** (22e976e)
- **reverseproxy: reduce allocation/CPU overhead in request hot paths (#7925)** (0476754)
- **caddyconfig: cancel HTTP loader requests with context (#7918)** (7d26d34)
- **log: don't allow overwriting singly-assigned vals (#7927)** (64b64c6)
- **caddyauth: isolate provider responses to prevent cross-provider clobbering (#7904)** (e096ca9)
- **fileserver: speed up directory browsing for large directories (#7903)** (2adc763)
- **encode: flush headers immediately for server-sent events responses (#7905)** (df44d6c)
- **encode: reduce allocations in AcceptedEncodings (#7847)** (323e3fe)
- **caddyconfig: Register nested named-route invokes transitively (#7898)** (54a6b8b)
- **caddyhttp: use canonical header key casing to avoid re-canonicalization (#7911)** (3be8dab)
- **rewrite: preserve non-canonical path encoding after uri replace (#7907)** (c96bca1)
- **Set the QUIC InitialPacketSize to 1200 bytes (#7886)** (c5b66cf)
- **deps: update GitHub Actions and Go modules (#7876)** (cba4f9a)
- **pki: Handle error immediately after reading root from disk (#7896)** (9738f49)
- **logging: hash query parameter values in QueryFilter (#7884)** (986753a)
- **caddyfile: treat quoted braces as literal arguments (#7875)** (873fac5)
- **reverseproxy: save dial info in a context key instead of a variable key to avoid race conditions when forward_auth is used (#7859)** (1830809)
- **reverseproxy: compare sticky-session cookie hash in constant time (#7853)** (75c988d)
- **core: preserve metrics registry in Context.WithValue (#7861)** (4e62095)
- **http: normalize method names to uppercase in MatchMethod.Provision (#7832)** (f450068)
- **Update human and agent contributing guidelines** (51a4bde)
- **caddyhttp: Clean up variable scope in vars matcher** (5760382)
- **caddyhttp: Document dropping underscore headers** (30f0ddd)
- **browse: Update Caddy logo** (6ab855d)
- **reverseproxy: log status 499 instead of 0 when client disconnects (#7827)** (d2e0ad1)
- **Remove -v from tests** (ab56721)
- **readme: Update logo** (4dbe0a9)
- **rewrite: scope keyed query replace to its named key (#7818)** (ae9bc02)
- **fileserver: append repeated `hide` subdirectives instead of overwriting (#7817)** (39c9a85)
- **Merge commit from fork** (25b3eab)
- **forwardauth: error on duplicate uri subdirective (#7814)** (0f7f8e9)
- **caddyhttp: Default max_header_bytes to 16 KiB** (4fd8c87)
- **reverseproxy: validate on weighted_round_robin loadbalancing policy (#7807)** (55b3397)
- **cmd: colored error message in WrapCommandFuncForCobra (#7760) (#7768)** (d730df2)
- **httpcaddyfile: error on duplicate named_routes (#7800)** (3b7bde8)
- **reverseproxy: replace placeholders specified for sni while using http3 (#7737)** (fcc7860)

### Chore
- **build: bump all dependencies - (Go 1.26 floor) (#8056)** (90ccea7)
- **chore: remove AI moderator workflow (#8059)** (8c0631b)
- **chore(deps): bump cel-go and switch import to new url (#8030)** (df77f8b)
- **build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#8028)** (894442f)
- **build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 (#7984)** (15ee32d)
- **chore: preserve canonical header keys (#7964)** (8257349)
- **chore: fix lint errors from newer golangci-lint (#7958)** (4974956)
- **build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#7908)** (ff6da12)
- **chore: fix sabotage spelling in nolint comments (#7892)** (93c0721)
- **build(deps): bump cel-go from v0.28.1 to v0.29.2 (#7872)** (b2693fb)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/caddyserver/caddy?utm_source=github-action)._