Starstruk Logo MarkStarstruk

v2.11.57 v3.7.13

high risk

NodePassProject/AnywhereSep 4, 2026 → Sep 4, 20260 days between releases

What's New

Upgrade to v3.7.13 adds 2 CVE fixes and updates dependencies like lego and quic-go.

Breaking Changes

  • Disables recursive NSS propagation for DNS challenge
  • Do not require recursive nameservers propagation for DNS-01 challenge

Improvements

  • Updated dependencies lego and quic-go
  • Security hardening for request handling
  • Improved server security by denying opaque request targets
  • Fixed sticky cookie expiration
  • Fixed TLS resource namespace mismatch logs

Bug Fixes

  • Do not require recursive nameservers propagation for DNS-01 challenge
  • Ignore negated matchers when parsing rule domains
  • Build collision-free item key in Consul Catalog and Nomad providers
  • Bump github.com/go-acme/lego/v5 to v5.4.1
  • Fixed sticky cookie expiration

Upgrade Notes

Please read the migration guide for v3.x as upgrading from v2.x may involve configuration changes. Note the change in default DNS challenge propagation behavior.

The Two Releases

v2.11.57

v2.11.57

Sep 4, 2026· 2 months ago

Addresses specific security vulnerabilities and applies security fixes found in the v3.x series, including improved HTTP/3 handling and server-side request validation.

Full release notes
v3.7.13

v3.7.13

Sep 4, 2026· 2 months ago

This release focuses on patching multiple security vulnerabilities (CVEs) and updating dependencies like `lego` and `quic-go`. It includes security hardening for request handling and fixes various bugs in ACME, HTTP/3, and Kubernetes providers.

Full release notes