Skip to content

build(deps): bump github.com/caddyserver/caddy/v2 from 2.9.0 to 2.11.5 - #82

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/github.com/caddyserver/caddy/v2-2.11.5
Closed

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/github.com/caddyserver/caddy/v2-2.11.5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 4, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/caddyserver/caddy/v2 from 2.9.0 to 2.11.5.

Release notes

Sourced from github.com/caddyserver/caddy/v2's releases.

v2.11.4

This release patches more security, security-adjacent, and normal bugs. The FrankenPHP project has collaborated on PHP-adjacent patches, which we are grateful for.

The recent surge of patches is mostly attributed to token predictors. We have had to reject more than 75% of "security" reports because they were AI slop spam (or just lazy/incorrect). Please use LLMs and agents wisely to avoid wasting precious maintainer resources. We have started blocking offending accounts that spam slop reports. Thank you to all who submit responsible reports following our security policy to make the project better. We appreciate that the community deems the Caddy project worthy of contribution to improve the broader ecosystem!

Security-related patches:

  • caddyhttp: Normalize Windows backslashes in path matcher (thanks @​Vincent550102)
  • rewrite: Prevent placeholder re-expansion in injected query (thanks @​WhiskerEnt)
  • templates: Improved stripHTML action to more reliably remove malformed HTML (thanks to @​jmrcsnchz)
  • caddyhttp: Ignore header fields with underscores to prevent collisions (thanks @​Vincent550102 for the report and @​dunglas for the patch)

⚠️ These security patches may be breaking if your application relies on the buggy behaviors.

There are also several other various fixes and enhancements by many other contributors. Thank you everyone who participated!

What's Changed

New Contributors

... (truncated)

Commits
  • 0a137e2 caddyhttp: use errors.AsType for request body limit errors (#8090)
  • 90efc8f go.mod: Upgrade CertMagic, acmez, ZeroSSL, & some others
  • ff112bb caddyhttp: wait for servers from previous configs on exit (#8009)
  • 90ccea7 build: bump all dependencies - (Go 1.26 floor) (#8056)
  • 5ee9a2d httpcaddyfile: new tls_automate_names global option (#8015)
  • 256df3c map: reject malformed destination placeholders (#8074)
  • ea1e94b map: Distinguish duplicate literal and regexp inputs (#8067)
  • 69ec5df caddyauth: only replace known placeholders in basic auth credentials (#8017)
  • fbc88ae internal: fix MaxSizeSubjectsListForLog off-by-one when maxToDisplay is `...
  • 81a0b6d requestbody: replace only known placeholders in the set body (#8008)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [github.com/caddyserver/caddy/v2](https://github.com/caddyserver/caddy) from 2.9.0 to 2.11.5.
- [Release notes](https://github.com/caddyserver/caddy/releases)
- [Commits](caddyserver/caddy@v2.9.0...v2.11.5)

---
updated-dependencies:
- dependency-name: github.com/caddyserver/caddy/v2
  dependency-version: 2.11.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 4, 2026
@mohammed90 mohammed90 closed this Nov 4, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 4, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/go_modules/github.com/caddyserver/caddy/v2-2.11.5 branch November 4, 2026 18:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant