v1.14.5

This release improves DNS transport security and operational reliability, with
safer DoH/DoH3 handling, enhanced forwarding configuration, and improved dnstap
support. It also adds robustness improvements across file serving, secondary
zones, transfers, rewrites, hosts handling, and error processing, while fixing
several edge cases in DNS response handling.

## Brought to You By

Aaron Mark
Amirhossein Ebrahimzade
Antoine
Baltasar Blanco
Cedric Wang
Ilya Kulakov
Immanuel Tikhonov
Jaime Hablutzel
Jonathan Tooker
Omkhar Arasaratnam
Pavel Lazureykis
SEONGHYUN HONG
Saleh
Thomas Gosteli
Ville Vesilehto
Yong Tang
houyuwushang
rpb-ant

## Noteworthy Changes

core: Accept scoped IPv6 addresses in transfer targets (https://github.com/coredns/coredns/pull/8204)
core: Bound DoQ stream read with the server read timeout (https://github.com/coredns/coredns/pull/8231)
core: Classify nxdomain without soa as denial (https://github.com/coredns/coredns/pull/8199)
core: Guard Join against an empty label slice (https://github.com/coredns/coredns/pull/8225)
core: Propagate HTTPRequestValidateFunc to all configs in a server block (https://github.com/coredns/coredns/pull/8169)
core: Sanitize DoH/DoH3 request parse errors (https://github.com/coredns/coredns/pull/8254)
core: Use Go TLS defaults (https://github.com/coredns/coredns/pull/8227)
core: Add Config.UDPDecorateWriterFunc for external plugins (https://github.com/coredns/coredns/pull/8257)
plugin/auto: Warn on duplicate zone file origins (https://github.com/coredns/coredns/pull/8191)
plugin/cache: Add regression test for AD bit not partitioning the cache (https://github.com/coredns/coredns/pull/8214)
plugin/dnstap: Close the previous connection before reconnecting (https://github.com/coredns/coredns/pull/8224)
plugin/dnstap: Fix self-deadlock in listener broadcast on client flush error (https://github.com/coredns/coredns/pull/8260)
plugin/dnstap: Store IPv4-mapped IPv6 addresses as 4 octets with SocketFamily INET (https://github.com/coredns/coredns/pull/8186)
plugin/erratic: Apply default truncate amount of 2 for bare `truncate` (https://github.com/coredns/coredns/pull/8240)
plugin/file: Return SOA in authority for negative CNAME target answers (https://github.com/coredns/coredns/pull/8226)
plugin/file: Run additional processing for wildcard answers (https://github.com/coredns/coredns/pull/8222)
plugin/forward: Add doh support (https://github.com/coredns/coredns/pull/8004)
plugin/forward: Make dnstap FORWARDER_* describe the socket from CoreDNS to upstream (https://github.com/coredns/coredns/pull/8184)
plugin/forward: Make per-upstream read timeout configurable (https://github.com/coredns/coredns/pull/8205)
plugin/forward: Restore old behavior forward plugin continue on empty conf file (https://github.com/coredns/coredns/pull/8203)
plugin/hosts: Add wildcard support (https://github.com/coredns/coredns/pull/8185)
plugin/hosts: Fall through unsupported query types (https://github.com/coredns/coredns/pull/8193)
plugin/hosts: Fix data race between lookups and reload (https://github.com/coredns/coredns/pull/8253)
plugin/kubernetes: Fix AXFR panic when nsAddrs returns multiple records (https://github.com/coredns/coredns/pull/8256)
plugin/local: Handle names under .localhost. (https://github.com/coredns/coredns/pull/8151)
plugin/log: Synthesize deferred error responses (https://github.com/coredns/coredns/pull/8200)
plugin/rewrite: Fix nil-pointer panic in EDNS0 response reversion with no OPT record (https://github.com/coredns/coredns/pull/8190)
plugin/rewrite: Restore the original question on empty replies (https://github.com/coredns/coredns/pull/8212)
plugin/secondary: Parse catalog zones after transfer (https://github.com/coredns/coredns/pull/8209)
plugin/secondary: Stop update loop on reload shutdown (https://github.com/coredns/coredns/pull/8198)
plugin/trace: Correct Zipkin v2 endpoint docs (https://github.com/coredns/coredns/pull/8202)
plugin/transfer: Configure notify source address (https://github.com/coredns/coredns/pull/8192)
plugin/transfer: Fix panic in CoreDNS transfer plugin caused by empty DNS record (https://github.com/coredns/coredns/pull/8207)
plugin/tsig: Don't echo client's TSIG.Error if verification is successful (https://github.com/coredns/coredns/pull/8215)