v2.11.57 v3.7.13
high risk
alibaba/MNNSep 4, 2026 → Sep 4, 20260 days between releases
What's New
Major version jump from v2.11.57 to v3.7.13 with security fixes and dependency updates
Breaking Changes
- Major version jump from v2 to v3 requires migration
- ACME DNS challenge propagation behavior changed (no recursive requirement)
Improvements
- Bumped github.com/go-acme/lego/v5 to v5.4.1 and quic-go to v0.62.0
- Dedicated a transport per HTTP/3 client connection
- Improved ACME DNS challenge propagation logic
Bug Fixes
- Fixed additional CVEs (GHSA-v67p, GHSA-8fcf)
- Fixed sticky cookie expiration
- Prevented user enumeration in basic auth
- Ignore negated matchers when parsing rule domains
- Build collision-free item keys in Consul/Nomad providers
Upgrade Notes
Upgrading requires reading the v3.7 migration guide. Note the ACME DNS challenge changes where recursive nameservers are no longer required by default.
The Two Releases
v2.11.57
v2.11.57
Sep 4, 2026· 2 months ago
A maintenance release for the v2.11 branch addressing specific security vulnerabilities and improving request handling for ACME, HTTP/3, and server configurations.
Full release notesv3.7.13
v3.7.13
Sep 4, 2026· 2 months ago
This release focuses on security by fixing multiple CVEs and updating dependencies for ACME, HTTP/3, and QUIC libraries. It includes various bug fixes for middleware, authentication, and server configuration handling.
Full release notes