Release Proposal: v2.11.1

[github-actions]

Release Proposal: v2.11.1

Target Commit: 6610e2f1bd8f54853006eefd3849c9965190e57f
Requested by: @francislavoie
Commit Status: This is the latest commit (HEAD)

This PR proposes creating release tag v2.11.1 at commit 6610e2f1bd8f54853006eefd3849c9965190e57f.

Approval Process

This PR requires approval from 2+ maintainers before the tag can be created.

What happens next?

1. Maintainers review this proposal
2. When 2+ maintainer approvals are received, an automated workflow will post tagging instructions
3. A maintainer manually creates and pushes the signed tag
4. The release workflow is triggered automatically by the tag push
5. Upon release completion, this PR is closed and the branch is deleted

Changes Since Last Release

• reverseproxy: make error chan bigger when reverse proxying websocket (reverseproxy: make error chan bigger when reverse proxying websocket #7419) (80f2ae9)
• headers: Make ApplyTo nil-safe (headers: Make ApplyTo nil-safe #7426) (6a57142)
• Revise top of readme to include Warp sponsorship section (28103aa)
• chore: Dumb prealloc lint fix (chore: Dumb prealloc lint fix #7430) (90972fb)
• update quic-go to v0.59.0 (update quic-go to v0.59.0 #7431) (5168acf)
• reverseproxy: fix error when remote address is not an IP (reverseproxy: Avoid returning error if remote address is not an IP #7429) (62134d6)
• caddyconfig: Fix indentation of multiline strings in fmt (caddy fmt does not format multi-line strings properly #7425) (caddyfile: Fix indentation of multiline strings in fmt (#7425) #7433) (e9d290d)
• core: Embed time/tzdata (core: Embed time/tzdata #7432) (cbebc12)
• caddyfile: add observe_catchall_hosts option (caddyfile: add observe_catchall_hosts option #7434) (e40bd01)
• core: Show JSON error offsets where possible (core: Show JSON error offsets where possible #7437) (d269405)
• autohttps: deterministic logic and strict bind checking on Linux (autohttps: deterministic logic and strict bind checking on Linux #7435) (565c1c3)
• caddyhttp: Reject invalid Host header (fix HTTP/1.1 Request Returns 200 with empty Host header #7449) (7d24124)
• caddtls: Skip .ts.net domains for ECH (Support per site ECH config in caddyfile #6971) (935b09d)
• reverseproxy: Customizable dial network for SRV upstreams (3bb2267)
• caddytls: Check type assertion (e0f8d9b)
• Require disclosure of LLM usage in security reports (40927d2)
• admin: Reject requests with Sec-Fetch-Mode headers (42ca010)
• Update detail in readme (58968b3)
• reverseproxy: Set Host to {upstream_hostport} automatically if TLS (reverseproxy: Set Host to {upstream_hostport} automatically if TLS #7454) (2ae0f7a)
• caddyhttp: Lowercase comparison when matching with escape sequence (bd374ca)
• caddyhttp: Use case-insensitive comparison for large Host lists (1f43e85)
• Update LLM disclosure requirements in SECURITY.md (5ff5077)
• Update SECURITY.md (96f142c)
• Merge commit from fork (7c28c0c)
• reverseproxy: fix X-Forwarded-* headers for Unix socket requests (reverseproxy: fix X-Forwarded-* headers for Unix socket requests #7463) (03e6e43)
• use math/rand/v2 instead of math/rand (chore: use math/rand/v2 instead of math/rand #7413) (47f3e8f)
• admin: Enforce origin implicitly based on request headers (72ac479)
• chore: bump Go to v1.26 (chore: bump Go to v1.26 #7466) (c0af7b6)
• acmeserver: warn when policy rules unset (acmeserver: warn when policy rules unset #7469) (0188ef2)
• caddytls: Return errors instead of nil in client auth provisioning (caddytls: Return errors instead of nil in client auth provisioning #7464) (d42d39b)
• go.mod: update nebula v1.10.3 to resolve cve (fix(deps): update nebula v1.10.3 to resolve cve #7471) (80bf818)
• caddytls: Finish removing prefer_wildcard (6718bd4)
• caddyfile: Add renewal_window_ratio global option and tls subdirective (caddyfile: Add renewal_window_ratio global option #7473) (929d0e5)
• httpcaddyfile: Override global dns with acme_dns (fix Global dns option discrepancy between docs and behaviour #7294) (httpcaddyfile: Override global dns with acme_dns (fix #7294) #7458) (d6a6b48)
• pki: add per-CA configurable maintenance_interval and renewal_window_ratio (pki: add per-CA configurable maintenance_interval and renewal_window_ratio #7479) (affbb99)
• chore: Bump zerossl dependency to 0.1.5 (chore: Bump zerossl dependency to 0.1.5 #7489) (f2213e9)
• chore: Remove obsolete comment in ech.go (chore: Remove obsolete comment in ech.go #7487) (ff4f79a)
• caddyhttp: Option to disable 0-RTT (caddyhttp: Option to disable 0-RTT #7485) (d64c7e6)
• dep: upgrade cel-go (dep: upgrade cel-go #7478) (23d07ac)
• build(deps): bump the all-updates group across 1 directory with 12 updates (build(deps): bump the all-updates group across 1 directory with 12 updates #7490) (8a18acc)
• refactor: use strings.Builder to improve performance (refactor: use strings.Builder to improve performance #7364) (68d5002)
• chore: fix some comments to improve readability (chore: fix some comments to improve readability #7395) (b8b00d9)
• caddytls: Enable debug logging for DNSManager (caddytls: Enable debug logging for DNSManager #7491) (9fe694c)
• encode: Implement Flush for legacy compatibility (bdcdaf7)
• caddytest: make TestReverseProxyHealthCheck deterministic with poll instead of sleep (caddytest: make TestReverseProxyHealthCheck deterministic with poll instead of sleep #7474) (091add5)
• admin: Fix tests locally, properly isolate storage (admin: Fix tests locally, properly isolate storage #7486) (3adcafd)
• chore: Add nolints to work around haywire linters (chore: Add nolints to work around haywire linters #7493) (95941a7)
• Revert "listeners: Add support for named socket activation (listeners: Add support for named socket activation #7243)" (6772ffb)
• build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 #7497) (db256b5)
• fileserver: Replace with \ in file matcher paths (a2825c5)
• Merge commit from fork (eec32a0)
• Merge commit from fork (a108119)
• fileserver: Fix tests on Windows (cb436f0)
• go.mod: Upgrade dependencies (03243e4)
• chore: Disable windows/arm build target (Go 1.26 disabled) (chore: Disable windows/arm build target (Go 1.26 disabled) #7503) (6610e2f)

Release Checklist

• All tests pass
• Security review completed
• Documentation updated
• Breaking changes documented

---

Note: Tag creation is manual and requires a signed tag from a maintainer.

[github-actions]

✅ Approval Quorum Reached

This release proposal has been approved by 2 maintainers: @francislavoie, @mohammed90

Tagging Instructions

A maintainer should now create and push the signed tag:

git checkout 6610e2f1bd8f54853006eefd3849c9965190e57f
git tag -s v2.11.1 -m "Release v2.11.1"
git push origin v2.11.1
git checkout -

The release workflow will automatically start when the tag is pushed.

[github-actions]

🚀 Release Workflow Started

• Tag: v2.11.1
• Signed by key: 7P4LDj+mglsDSwpCoQU51fWKsU8A1wj9LZLtRC+Qzv0
• Commit: 6610e2f
• Approved by: @francislavoie, @mohammed90

Release workflow is now running. This PR will be updated when the release is published.

[github-actions]

✅ Release Published

The release has been successfully published and is now available.