v1.0.2
caddyserver/caddyv1.0.2Aug 13, 2019by mholt
AI Summary
This release patches HTTP/2 security vulnerabilities using Go 1.12.8 and adjusts port parsing behavior.
Key Highlights
- Patched HTTP/2 implementation against security vulnerabilities reported by Netflix.
- Adjusted behavior for service names in ports (e.g., `example.com:https`).
Breaking Changes
- Service names in port syntax now require numeric ports or URL schemes (e.g., `https://example.com`).
New Features
- Security patch
- Go 1.12.8 upgrade
Full Release Notes
This release uses Go 1.12.8 to patch the HTTP/2 implementation against the [security vulnerabilities reported today](https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md). One minor [breaking change in Go 1.12.8](https://github.com/golang/go/commit/3226f2d492963d361af9dfc6714ef141ba606713) might affect some configurations that use service name in the port of their Caddyfiles, like so: `example.com:https` - we've smoothed this over so the behavior of Caddy is the same but if you encounter any odd inconsistencies, switch to using numeric ports or proper URL scheme: either `https://example.com` (recommended) or `example.com:443`.