Release Proposal: v2.11.0

[github-actions]

Release Proposal: v2.11.0

Target Commit: cb436f0a0ed62e0a5d4af158486bba39fc575fe1
Requested by: @mholt
Commit Status: This is the latest commit (HEAD)

This PR proposes creating release tag v2.11.0 at commit cb436f0a0ed62e0a5d4af158486bba39fc575fe1.

Approval Process

This PR requires approval from 2+ maintainers before the tag can be created.

What happens next?

1. Maintainers review this proposal
2. When 2+ maintainer approvals are received, an automated workflow will post tagging instructions
3. A maintainer manually creates and pushes the signed tag
4. The release workflow is triggered automatically by the tag push
5. Upon release completion, this PR is closed and the branch is deleted

Changes Since Last Release

• reverseproxy: make error chan bigger when reverse proxying websocket (reverseproxy: make error chan bigger when reverse proxying websocket #7419) (80f2ae9)
• headers: Make ApplyTo nil-safe (headers: Make ApplyTo nil-safe #7426) (6a57142)
• Revise top of readme to include Warp sponsorship section (28103aa)
• chore: Dumb prealloc lint fix (chore: Dumb prealloc lint fix #7430) (90972fb)
• update quic-go to v0.59.0 (update quic-go to v0.59.0 #7431) (5168acf)
• reverseproxy: fix error when remote address is not an IP (reverseproxy: Avoid returning error if remote address is not an IP #7429) (62134d6)
• caddyconfig: Fix indentation of multiline strings in fmt (caddy fmt does not format multi-line strings properly #7425) (caddyfile: Fix indentation of multiline strings in fmt (#7425) #7433) (e9d290d)
• core: Embed time/tzdata (core: Embed time/tzdata #7432) (cbebc12)
• caddyfile: add observe_catchall_hosts option (caddyfile: add observe_catchall_hosts option #7434) (e40bd01)
• core: Show JSON error offsets where possible (core: Show JSON error offsets where possible #7437) (d269405)
• autohttps: deterministic logic and strict bind checking on Linux (autohttps: deterministic logic and strict bind checking on Linux #7435) (565c1c3)
• caddyhttp: Reject invalid Host header (fix HTTP/1.1 Request Returns 200 with empty Host header #7449) (7d24124)
• caddtls: Skip .ts.net domains for ECH (Support per site ECH config in caddyfile #6971) (935b09d)
• reverseproxy: Customizable dial network for SRV upstreams (3bb2267)
• caddytls: Check type assertion (e0f8d9b)
• Require disclosure of LLM usage in security reports (40927d2)
• admin: Reject requests with Sec-Fetch-Mode headers (42ca010)
• Update detail in readme (58968b3)
• reverseproxy: Set Host to {upstream_hostport} automatically if TLS (reverseproxy: Set Host to {upstream_hostport} automatically if TLS #7454) (2ae0f7a)
• caddyhttp: Lowercase comparison when matching with escape sequence (bd374ca)
• caddyhttp: Use case-insensitive comparison for large Host lists (1f43e85)
• Update LLM disclosure requirements in SECURITY.md (5ff5077)
• Update SECURITY.md (96f142c)
• Merge commit from fork (7c28c0c)
• reverseproxy: fix X-Forwarded-* headers for Unix socket requests (reverseproxy: fix X-Forwarded-* headers for Unix socket requests #7463) (03e6e43)
• use math/rand/v2 instead of math/rand (chore: use math/rand/v2 instead of math/rand #7413) (47f3e8f)
• admin: Enforce origin implicitly based on request headers (72ac479)
• chore: bump Go to v1.26 (chore: bump Go to v1.26 #7466) (c0af7b6)
• acmeserver: warn when policy rules unset (acmeserver: warn when policy rules unset #7469) (0188ef2)
• caddytls: Return errors instead of nil in client auth provisioning (caddytls: Return errors instead of nil in client auth provisioning #7464) (d42d39b)
• go.mod: update nebula v1.10.3 to resolve cve (fix(deps): update nebula v1.10.3 to resolve cve #7471) (80bf818)
• caddytls: Finish removing prefer_wildcard (6718bd4)
• caddyfile: Add renewal_window_ratio global option and tls subdirective (caddyfile: Add renewal_window_ratio global option #7473) (929d0e5)
• httpcaddyfile: Override global dns with acme_dns (fix Global dns option discrepancy between docs and behaviour #7294) (httpcaddyfile: Override global dns with acme_dns (fix #7294) #7458) (d6a6b48)
• pki: add per-CA configurable maintenance_interval and renewal_window_ratio (pki: add per-CA configurable maintenance_interval and renewal_window_ratio #7479) (affbb99)
• chore: Bump zerossl dependency to 0.1.5 (chore: Bump zerossl dependency to 0.1.5 #7489) (f2213e9)
• chore: Remove obsolete comment in ech.go (chore: Remove obsolete comment in ech.go #7487) (ff4f79a)
• caddyhttp: Option to disable 0-RTT (caddyhttp: Option to disable 0-RTT #7485) (d64c7e6)
• dep: upgrade cel-go (dep: upgrade cel-go #7478) (23d07ac)
• build(deps): bump the all-updates group across 1 directory with 12 updates (build(deps): bump the all-updates group across 1 directory with 12 updates #7490) (8a18acc)
• refactor: use strings.Builder to improve performance (refactor: use strings.Builder to improve performance #7364) (68d5002)
• chore: fix some comments to improve readability (chore: fix some comments to improve readability #7395) (b8b00d9)
• caddytls: Enable debug logging for DNSManager (caddytls: Enable debug logging for DNSManager #7491) (9fe694c)
• encode: Implement Flush for legacy compatibility (bdcdaf7)
• caddytest: make TestReverseProxyHealthCheck deterministic with poll instead of sleep (caddytest: make TestReverseProxyHealthCheck deterministic with poll instead of sleep #7474) (091add5)
• admin: Fix tests locally, properly isolate storage (admin: Fix tests locally, properly isolate storage #7486) (3adcafd)
• chore: Add nolints to work around haywire linters (chore: Add nolints to work around haywire linters #7493) (95941a7)
• Revert "listeners: Add support for named socket activation (listeners: Add support for named socket activation #7243)" (6772ffb)
• build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 #7497) (db256b5)
• fileserver: Replace with \ in file matcher paths (a2825c5)
• Merge commit from fork (eec32a0)
• Merge commit from fork (a108119)
• fileserver: Fix tests on Windows (cb436f0)

Release Checklist

• All tests pass
• Security review completed
• Documentation updated
• Breaking changes documented

---

Note: Tag creation is manual and requires a signed tag from a maintainer.

[github-actions]

🚫 Release Proposal Cancelled

This release proposal for v2.11.0 was closed without creating the tag.

If you want to proceed with this release later, you can create a new release proposal.

[mholt]

Actually hang on, I thought the deps were updated but some are missing.