Starstruk Logo MarkStarstruk

v3.7.11

anomalyco/opentuiv3.7.11Aug 19, 2026by github-actions[bot]

AI Summary

This release introduces several new options for the Kubernetes CRD and Gateway API providers to prevent naming collisions. It enhances security by bumping authentication libraries and adds configuration options for TLS fallback and service name scoping.

Key Highlights

  • Adds options to restrict TLS resources namespace in Kubernetes CRD provider
  • Adds safe naming option to avoid collisions for Kubernetes CRD provider
  • Adds an option to disable the fallback to the default TLS options
  • Preserves encoded path segments in Gateway API URLRewrite
  • Bumps go-http-auth library for security

New Features

  • Add an option to restrict the namespace of the default TLS resources
  • Add safe naming option to avoid collisions for Kubernetes CRD provider
  • Add an option to disable the fallback to the default TLS options

Full Release Notes

**Important:** Please read the [migration guide](https://doc.traefik.io/traefik/v3.7/migrate/v3/#v3711).

**CVE fixed:**
- Advisory [GHSA-5w68-77r2-r64c](https://github.com/traefik/traefik/security/advisories/GHSA-5w68-77r2-r64c)
- Advisory [GHSA-g55h-rg46-x9c5](https://github.com/traefik/traefik/security/advisories/GHSA-g55h-rg46-x9c5)
- Advisory [GHSA-j994-9gqj-9hwq](https://github.com/traefik/traefik/security/advisories/GHSA-j994-9gqj-9hwq)
- Advisory [GHSA-m6wx-622r-48r9](https://github.com/traefik/traefik/security/advisories/GHSA-m6wx-622r-48r9)

**Bug fixes:**
- **[fastproxy]** Reject out-of-range status codes from backends when using FastProxy ([#13635](https://github.com/traefik/traefik/pull/13635) @gndz07)
- **[http3]** Bump github.com/quic-go/quic-go to v0.61.0 ([#13688](https://github.com/traefik/traefik/pull/13688) @jnoordsij)
- **[k8s/crd]** Prevent generated name collisions in the Kubernetes CRD provider ([#13656](https://github.com/traefik/traefik/pull/13656) @rtribotte)
- **[k8s/crd]** Add an option to restrict the namespace of the default TLS resources ([#13665](https://github.com/traefik/traefik/pull/13665) @rtribotte)
- **[k8s/crd]** Scope generated Kubernetes Service names to their parent in the CRD provider ([#13668](https://github.com/traefik/traefik/pull/13668) @rtribotte)
- **[k8s/crd]** Name failover generated services after the referenced Kubernetes Service ([#13677](https://github.com/traefik/traefik/pull/13677) @rtribotte)
- **[k8s/crd]** Add safe naming option to avoid collisions for Kubernetes CRD provider ([#13689](https://github.com/traefik/traefik/pull/13689) @gndz07)
- **[k8s/gatewayapi]** Preserve encoded path segments in Gateway API URLRewrite and RequestRedirect ([#13641](https://github.com/traefik/traefik/pull/13641) @gndz07)
- **[k8s/gatewayapi]** Fix Gateway API router rules ([#13645](https://github.com/traefik/traefik/pull/13645) @rtribotte)
- **[k8s/ingress-nginx]** Dedupe client-auth TLS options across ingresses sharing a host for ingress-nginx provider ([#13638](https://github.com/traefik/traefik/pull/13638) @gndz07)
- **[k8s/ingress-nginx]** Apply auth, custom-headers, custom errors and ssl-redirect to ingress default backend ([#13575](https://github.com/traefik/traefik/pull/13575) @rtribotte)
- **[k8s/ingress-nginx]** Honor asDefault and exclude internal entrypoints from default selection for ingress-nginx provider ([#13629](https://github.com/traefik/traefik/pull/13629) @gndz07)
- **[k8s/ingress]** Enforce crossProviderNamespace for Kubernetes Ingress service middleware ([#13670](https://github.com/traefik/traefik/pull/13670) @gndz07)
- **[middleware, authentication]** Bump github.com/containous/go-http-auth to b975dcaa8c48 ([#13636](https://github.com/traefik/traefik/pull/13636) @kevinpollet)
- **[tls]** Add an option to disable the fallback to the default TLS options ([#13639](https://github.com/traefik/traefik/pull/13639) @rtribotte)
- Bump golang.org/x dependencies ([#13699](https://github.com/traefik/traefik/pull/13699) @mmatur)

**Documentation:**
- **[accesslogs]** Clarify OriginStatus and DownstreamStatus in access logs documentation ([#13609](https://github.com/traefik/traefik/pull/13609) @rtribotte)
- **[api]** Fix doubled word in API/dashboard reference docs ([#13663](https://github.com/traefik/traefik/pull/13663) @latent-9)
- **[docker]** Remove :ro from docker.sock ([#12656](https://github.com/traefik/traefik/pull/12656) @bluepuma77)
- **[k8s/gatewayapi]** Clarify v3.7.10 migration guide for Gateway API 1.6.1 ([#13628](https://github.com/traefik/traefik/pull/13628) @rtribotte)
- **[k8s/gatewayapi]** Document the Experimental Channel CRDs requirement of the Kubernetes Gateway provider ([#13634](https://github.com/traefik/traefik/pull/13634) @rtribotte)
- **[k8s/ingress-nginx]** Docs: Update supported server snippet directives ([#13687](https://github.com/traefik/traefik/pull/13687) @rtsui-harmonicinc)
- **[middleware]** Add rejectStatusCode to the ipAllowList middleware configuration example ([#13664](https://github.com/traefik/traefik/pull/13664) @amazon7737)
- **[middleware]** Mark the errors middleware service option as required ([#13684](https://github.com/traefik/traefik/pull/13684) @lazerg)
- **[tls]** Document the TLS options conflict resolution ([#13640](https://github.com/traefik/traefik/pull/13640) @rtribotte)
- **[tls]** Clarify router TLS replaces entrypoint TLS ([#13630](https://github.com/traefik/traefik/pull/13630) @sornapudisuresh)
- Document Redis keyspace notifications requirement ([#13691](https://github.com/traefik/traefik/pull/13691) @omkar619-dev)
- Remove retired Go Report Card badge ([#13637](https://github.com/traefik/traefik/pull/13637) @yardenshoham)
- Restore the systemd socket activation documentation ([#13701](https://github.com/traefik/traefik/pull/13701) @lazerg)
- Update version support policy starting with v3.6 ([#13627](https://github.com/traefik/traefik/pull/13627) @nmengin)