Log message:
Revbump all Go packages after Go 1.26 update

Log message:
Revbump all Go packages after go126 update

Log message:
Revbump all Go packages after go126 security update

Log message:
caddy: update to 2.11.3, containing some security improvements

2.10.1

This is probably our biggest patch release ever -- not that lots of
things were broken, but there's lots of refinement happening thanks to
broader adoption and contributions from many more people. Just look at
the New Contributors below!

Anyway, this release does contain some bug fixes and dependency upgrades
which we hope will serve you well. Let us know if there's any issues!
And thank you to all who contributed, especially our reliable maintainer
team!

2.10.2

This is a hotfix release to fix a couple critical issues from v2.10.1

2.11.1

Our community is pleased to announce Caddy 2.11! Of note are new
features, numerous bug fixes including several security patches, and
various QoL ("quality-of-life") enhancements.

There are no code changes from v2.11.0 other than to a CI job. Due to a
recent external change that broke our release process, the first release
of 2.11 is v2.11.1.

Notable changes

- Encrypted ClientHello (ECH) keys are rotated automatically.
- Time-rolling options for logs.
- SIGUSR1 can now reload configuration if it was initially loaded from a
  file on the command line and did not get changed via the API.
- Reverse proxy now automatically rewrites the Host header to the
  address of the upstream when the upstream is HTTPS
- log_append can now log request and response bodies, useful for
  debugging.
- Our project now implements and requires Assistance Disclosures (for
  AI/LLMs) on issues, PRs, comments, replies, reviews, etc.
- Many, many other minor improvements and bug fixes.

Security patches

- fastcgi: CVE-2026-27590 by @dunglas and @AbdrrahimDahmani - Unicode
  case-folding length expansion causes incorrect split_path index
  (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport.
- admin: CVE-2026-27589 by @1seal - Cross-origin requests attempted with
  no-cors mode could cause some API requests to succeed; such requests
  are now blocked. (In order for this to be practically exploitable, a
  web browser executing a malicious web page must be running locally to
  a production Caddy process.)
- caddyhttp: CVE-2026-27588 by Asim Viladi Oglu Manizada - The Host
  matcher becomes case-sensitive for large host lists (>100), enabling
  host-based route/auth bypass.
- caddyhttp: CVE-2026-27587 by Asim Viladi Oglu Manizada - The Path
  matcher skips case normalization for escape sequences, enabling
  path-based route/auth bypass.
- caddytls: CVE-2026-27586 by @moscowchill - TLS client authentication
  silently fails open when CA certificate file is missing or malformed.
- caddyhttp: CVE-2026-27585 by @parrot409 - Improper sanitization of
  glob characters in file matcher may lead to bypassing security
  protections.

2.11.2

Caddy 2.11.2 contains numerous bug fixes and enhancements! I know that's
a lame summary but it's really all over the place.

2.11.3

This release improves several aspects of Caddy with minor features, bug
fixes, and security patches. Thank you to everyone and their bots who
contributed to help make this release the best one yet!

Security patches:

- fastcgi: Carrying over a patch from FrankenPHP for a bug that could
  allow non-PHP files to be executed
- vars: A more thorough fix for GHSA-m2w3-8f23-hxxf
- admin: Array index normalization to prevent remote admin socket auth
  bypass
- admin: More rigorous path prefix matching to prevent remote admin
  socket auth bypass

We've also merged a couple PRs that fix upstream security bugs in other
projects like quic-go and CertMagic.

Log message:
Revbump all Go packages after go126 security update

Log message:
Revbump all Go packages after security update

Log message:
Revbump all Go packages after go126 update

Log message:
Revbump all Go packages after default version bump