Update module github.com/caddyserver/caddy/v2 to v2.10.2 #70
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Contributor
Author
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.10.0-beta.2->v2.10.2Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
caddyserver/caddy (github.com/caddyserver/caddy/v2)
v2.10.2Compare Source
This is a hotfix release to fix a couple critical issues from v2.10.1
What's Changed
acme_dnsregression by @francislavoie in #7199{block}by @BeeJay28 in #7189Changelog
551f793caddyfile: Fix importing nested tokens for{block}(#7189)16fe83chttp: Make logger first, before TLS provisioning (#7198)4564261httpcaddyfile: Fixacme_dnsregression (#7199)New Contributors
Full Changelog: caddyserver/caddy@v2.10.1...v2.10.2
v2.10.1Compare Source
This is probably our biggest patch release ever -- not that lots of things were broken, but there's lots of refinement happening thanks to broader adoption and contributions from many more people. Just look at the New Contributors below!
Anyway, this release does contain some bug fixes and dependency upgrades which we hope will serve you well. Let us know if there's any issues! And thank you to all who contributed, especially our reliable maintainer team!
This version of Caddy requires Go v1.25.0 or newer.
What's Changed
nilarg fromzapslog.NewHandlercall by @IndraGunawan in #6984{in,ex}cludeby @mohammed90 in #6995Commandsfunction not returning all registered commands by @hslatman in #7059{base,head}-refto dep review check by @mohammed90 in #7064Context.ApporContext.AppIfConfiguredwill return(val, nil)even if the app failed to provision or validate the first time by @alexandre-daubois in #7070caddy adaptto read from stdin by @bosdhill in #7163Changelog
44d078bacme_server: fix policy parsing in caddyfile (#7006)320c572admin: Make sure that any admin routers are provisioned when local/re… (#6997)49dac61bcrypt: add cost parameter to hash-password (#7149)4bfc3b9bcrypt: wrong cost flag name (#7168)4b01d77build(deps): bump github.com/cloudflare/circl from 1.6.0 to 1.6.1 (#7058)45c9341build(deps): bump golangci/golangci-lint-action from 6 to 8 (#7044)5bc2afbbuild(deps): bump the actions-deps group with 6 updates (#7142)007f406build(deps): bump the all-updates group across 1 directory with 17 updates (#7155)8524386caddyhttp: Compare paths w/o wildcard if prefixes differ (#7015)7590c9ccaddyhttp: Free up quic listener when stopping (#7177)b15ed9bcaddyhttp: refactor to use reflect.TypeFor (#7187)14a63a2caddyhttp: use the new http.Protocols to handle h1, h2 and h2c requests (#6961)731e6c2caddytls: Improve ECH error logging (close #7152)105eee6caddytls: Set local_ip, not remote_ip (#6952)b898873caddytls: fix regression in external certificate manager support (#7179)1481c04caddytls: wire up client_auth leaf verifier Caddyfile (#6772)19ff47acmd: Allowcaddy adaptto read from stdin (#7163)e633d01cmd: fixCommandsfunction not returning all registered commands (#7059)7099892core: Check for nil event origin (#7047)3d0b4facore: Clean up new config if it failed to run (#7068)051e73acore: Replace admin server later in provisionContext (#7004)fe41ff3core: Save app provisioning errors with context (#7070)e4447c4core: Use KeepAliveConfig to pass keepalive_interval to listener's accepted sockets (#7151)b9710c6fileserver: Add a few doc lines about Etag file content (#7173)3b4d966fileserver: Add sort buttons in grid mode (#7089)54d03cefileserver: Add support for .avif image format (#6988)790f3e0fileserver: denote license for embedded JavaScript for LibreJS (#7127)94147cafileserver: map invalid path errors to fs.ErrInvalid, and return 400 for any invalid path errors. (close #7008) (#7017)67debd0fileserver: set Range header for precompressed static files to force Content Length header to appear (#7042)89ed5f4fix: Remove nil arg from zapslog.NewHandler call (#6984)3723e89go.mod: Upgrade CertMagic to v0.24.03bd4135go.mod: Upgrade dependenciesa6d488ago.mod: update quic-go to v0.51.0 (#6972)11c6daego.mod: update quic-go to v0.53.0 (#7094)bbf1dfcheaders: Support placeholders in replacement search patterns (#7117)f11c780http: clean up listeners if some of the listeners fail to bind (#7176)fdf6108http: disable keepalive when KeepAliveInterval is negative (#7158)5b727bdhttpcaddyfile: Allow naked acme_dns if dns is set (fix #7091)0badb07httpcaddyfile: Fix generated config related to ACME global options092913ahttpcaddyfile: Prevent error handler from overriding sub-handler matchers (#6999)77dd12chttpcaddyfile: Validates TLS DNS challenge options (#7099)0f209f6httpcaddyfile: reject blocks in log_skip directive (#7056)716d72eintercept: implement Unwrap for interceptedResponseHandler (#7016)9f71483log: default logger should respect{in,ex}clude(#6995)33c88bdrefactor: replace HasPrefix+TrimPrefix with CutPrefix (#7095)ab3b2d6refactor: use slices.Equal to simplify code (#7141)1c596e3reverse_proxy: use the new KeepAliveConfig to set probe interval (#7157)aa3d20breverseproxy: Use DialTLSContext if ServerName has placeholder (#6955)737936creverseproxy: reference correct field name in LoadModule (#6978)1209b5creverseproxy: validate versions in http transport (#7112)New Contributors
Full Changelog: caddyserver/caddy@v2.10.0...v2.10.1
v2.10.0Compare Source
Caddy 2.10 is here! Aside from bug fixes, this release features:
x25519mlkem768cryptographic group by default.dnsglobal option in the Caddyfile, or in JSON config, it's thednsparameter in thetlsapp configuration.tls force_automatein the Caddyfile. The experimentalauto_https prefer_wildcardoption has been removed.dnsconfig: Now that several components of Caddy configuration may affect DNS records (ACME challenges, ECH publication, etc.), there is a newdnsglobal option that can be used to specify your DNS provider config in a single place. This prevents repetition of credentials for servers where all the domains are managed by a single DNS provider.Thank you to the many contributors who have helped to make this possible! 🎉 🥳 🍾
Encrypted ClientHello (ECH) details
(This is a brief overview. We recommend reading the full documentation.)
Typically, server names (domain names, or "SNI") are sent in the plaintext ClientHello when establishing TLS connections. With ECH, the true server name is encrypted (and wrapped) by an "outer" ClientHello which has a generic SNI of your choosing. With many sites on the same server sharing the same outer SNI, both clients and the server have more privacy related to domain names.
Caddy implements fully automated ECH, meaning that it generates (and soon, rotates), publishes, and serves ECH configurations simply by specifying a DNS provider, and the outer/public domain name to use.
Fully automated ECH requires a DNS module built into your Caddy binary. In order for a client, such as a browser, to know it can use ECH, and what parameters to use, the server's ECH configuration must be published. This config includes the public name, cryptographic parameters, and a public key for encrypting the inner ClientHello. By convention, browsers read the standardized HTTPS-type DNS record containing a
echSvcParamKey. Caddy sets this DNS record for all domains being protected, but it needs that DNS provider module plugged in and configured in order to do this. If you are already using the DNS ACME challenge, you should already have a DNS provider plugged in. If you prefer to build Caddy from source with a DNS module, it's easy with xcaddy, for example:$ xcaddy build --with github.com/caddy-dns/cloudflareThe minimum config needed to enable ClientHello is also the recommended config, as it maximizes privacy benefits in most situations. You just need the
echglobal option and a DNS provider specified. Here's an example using Cloudflare as the nameserver:Caddyfile:
{ debug # not required; recommended while testing dns cloudflare {env.CLOUDFLARE_API_KEY} ech ech.example.net } example.com { respond "Hello there!" }This protects all your sites (
example.comin this case) behind the public name ofech.example.net. (As another example, Cloudflare usescloudflare-ech.comfor all the sites it serves. We recommend choosing a single public domain and use it to protect all your sites.)The outer/public name you choose should point to your server. Caddy will obtain a certificate for this name in order to facilitate safe, reliable connections for clients when needed. Without a certificate, clients may be forced to connect insecurely, or fail to connect at all, in some cases, which not only leaves them vulnerable, but also risks exposing the names of your server's sites.
Caddy then uses the specified DNS provider to publish the ECH config(s) for your various site names. It creates (or augments) HTTPS-type records for the domains of your sites (not your ECH public name). Note that DNS provider modules are independently-maintained, and may not have been tested for compatibility with HTTPS-type records. Please contact your module's maintainers if you experience issues.
If you have more advanced configuration needs, you can use the JSON configuration (more details coming soon; for now, see #6862 or look at the source code; or use
caddy adaptto convert a Caddyfile to JSON).Testing and verifying Encrypted ClientHello
First make sure Caddy runs successfully with ECH enabled (and a DNS module) in the config. You should see logs that it is generating an ECH config and publishing it to your domain name(s).
You will need to use a client that supports ECH. Some custom builds of
curldo, and Firefox and modern Chrome-based browsers do as well, but you need to enable DNS-over-HTTPS or DNS-over-TLS first (since, obviously, querying DNS in plaintext for a protected domain name will expose the domain and defeat the purpose of ECH).If reusing an existing domain name, clear your DNS cache. Firefox has a way of doing this for its cache at
about:networking#dns.Once you have a suitable client, use Wireshark to capture network packets as you load your site. You should see only the outer/public name as SNI (ServerName Indicator) values in the packet capture. If at any time you see the true site name, ECH is not working properly -- it could be a client or server issue. Before filing a bug, please try to pinpoint it as a server issue first. But definitely report server bugs! Thank you!
(Note that ECH is not automatically published for CNAME'd domains, and the domain must already have a record in the zone.)
Commits
Beta 1:
96c5c55admin: fix index validation for PUT requests (#6824)3644ee3build(deps): bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 (#6876)eacd772build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.3 to 3.0.4 (#6871)9996d6abuild(deps): bump github.com/golang/glog from 1.2.2 to 1.2.4 (#6814)1115158caddyhttp: ResponseRecorder sets stream regardless of 1xx8861eaecaddytest: Support configuration defaults override (#6850)d7764dfcaddytls: Encrypted ClientHello (ECH) (#6862)a807fe0caddytls: Enhance ECH documentationbc3d497caddytls: Fix broken refactor7b8f350caddytls: Fix sni_regexp matcher to obtain layer4 contexts (#6804)2c4295ecaddytls: Initial support for ACME profilesd7872c3caddytls: Refactor sni matcher (#6812)172136acaddytls: Support post-quantum key exchange mechanism X25519MLKEM768066d770cmd: automatically set GOMEMLIMIT (#6809)1f35a8afastcgi: improve parsePHPFastCGI docs (#6779)22563a7file_server: use the UTC timezone for modified time (#6830)cfc3af6fix: update broken link to Ardan Labs (#6800)99073eago.mod: Upgrade CertMagic to v0.21.71641e76go.mod: Upgrade dependencies0d7c639go.mod: remove glog dependency (#6838)932dac1logging: Always set fields func; fix #68299e0e5a4logging: Fix crash if logging error is not HandlerError (#6777)904a0fareverse_proxy: re-add healthy upstreams metric (#6806)e7da3b2reverseproxy: Via header (#6275)9283770reverseproxy: ignore duplicate collector registration error (#6820)Beta 2:
f4432a3caddyfile: add error handling for unrecognized subdirective/options in various modules (#6884)84364ffcaddypki: Remove lifetime check at Caddyfile parse (fix #6878)adbe7f8caddytls: Only make DNS solver if not already set (fix #6880)d57ab21caddytls: Pointer receiver (fix #6885)4ebcfedcaddytls: Reorder provisioning steps (fix #6877)a686f7ccmd: Only set memory/CPU limits on run (fix #6879)1987620cmd: Promote undo maxProcs func to caller220cd1creverseproxy: more comments about buffering and add new tests (#6778)Beta 3:
b3e692ecaddyfile: Fix formatting for backquote wrapped braces (#6903)55c89cccaddytls: Convert AP subjects to punycode1f8dab5caddytls: Don't publish ECH configs if other records don't exist782a3c7caddytls: Don't publish HTTPS record for CNAME'd domain (fix #6922)49f9af9caddytls: Fix TrustedCACerts backwards compatibility (#6889)e276994caddytls: Initialize permission module earlier (fix #6901)39262f8caddytls: Minor fixes for ECH1735730core: add modularnetwork_proxysupport (#6399)86c620fgo.mod: Minor dependency upgradesaf2d33aheaders: Allow nil HeaderOps (fix #6893)dccf3d8requestbody: Add set option to replace request body (#5795)2ac09fdrequestbody: Fix ContentLength calculation after body replacement (#6896)v2.10.0:
f297bc0admin: Remove host checking for UDS (close #6832)0b2802fbuild(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#6960)5be77d0caddyauth: Set authentication provider error in placeholder (#6932)b06a949caddyhttp: Document side effect of HTTP/3 early data (close #6936)35c8c2dcaddytls: Add remote_ip to HTTP cert manager (close #6952)fb22a26caddytls: Allow missing ECH meta file1bfa111caddytls: Prefer managed wildcard certs over individual subdomain certs (#6959)ea77a9acaddytls: Temporarily treat "" and "@" as equivalent for DNS publication5a6b2f8events: Refactor; move Event into core, so core can emit events (#6930)137711ago.mod: Upgrade acmez and certmagic9becf61go.mod: Upgrade to libdns 1.0 beta APIs (requires upgraded DNS providers)6c38ae7reverseproxy: Add valid Upstream to DialInfo in active health checks (#6949)What's Changed
archives.format_overrides.formatby @mohammed90 in #6807Configuration
📅 Schedule: Branch creation - "before 8am on Monday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.