Release Proposal: v2.11.2

[github-actions]

Release Proposal: v2.11.2

Target Commit: ffb6ab0644f24c5ee6542aca6bd59b7a1b0a8f91
Requested by: @mholt
Commit Status: This is the latest commit (HEAD)

This PR proposes creating release tag v2.11.2 at commit ffb6ab0644f24c5ee6542aca6bd59b7a1b0a8f91.

Approval Process

This PR requires approval from 2+ maintainers before the tag can be created.

What happens next?

1. Maintainers review this proposal
2. When 2+ maintainer approvals are received, an automated workflow will post tagging instructions
3. A maintainer manually creates and pushes the signed tag
4. The release workflow is triggered automatically by the tag push
5. Upon release completion, this PR is closed and the branch is deleted

Changes Since Last Release

• reverseproxy: fix tls dialing w/ proxy protocol (reverseproxy: fix tls dialing w/ proxy protocol #7508) (d7b21c6)
• httpcaddyfile: Fix missing TLS connection policies when auto_https is default (Cannot get default_sni to work #7325) (httpcaddyfile: Fix missing TLS connection policies when auto_https is default (#7325) #7507) (7ffb640)
• http: Sort auto-HTTPS redirect routes by host specificity (fixes Unexpected automatic redirection #7390) (http: Sort auto-HTTPS redirect routes by host specificity (fix #7390) #7502) (76b198f)
• logging: add DirMode options and propagate FileMode to rotations (logging: add DirMode options and propagate FileMode to rotations #7335) (294dfff)
• logging: Support zstd roll compression (logging: Support zstd roll compression #7515) (9873752)
• caddyhttp: Avoid nil pointer dereference in proxyWrapper (caddyhttp: Avoid nil pointer dereference in proxyWrapper #7521) (9798f69)
• chore: Enable modernize linter (chore: Enable modernize linter #7519) (72eaf25)
• caddyhttp: Limit empty Host check to HTTP/1.1 (eac02ee)
• go.mod: Upgrade x/net (ce203aa)
• Revert "encode: Implement Flush for legacy compatibility" (06a05e3)
• cmd: Pass configFile, not configFlag, for reload command (cmd: Pass configFile, not configFlag, for reload command #7532) (cd9e166)
• caddyhttp: Evaluate tls.client placeholders more accurately (fix tls_client_subject set to literal {http.request.tls.client.subject} without client cert #7530) (caddyhttp: Evaluate tls.client placeholders more accurately (fix #7530) #7534) (174fa2d)
• tls: Add tls_resolvers global option for DNS challenge configuration (tls: Add tls_resolvers global option for DNS challenge configuration #7297) (f145bce)
• reverseproxy: query escape request urls when proxy protocol is enabled (reverseproxy: query escape request urls when proxy protocol is enabled #7537) (2ab043b)
• cmd: Custom binary names through CustomBinaryName and CustomLongDescription (cmd: Custom binary names through CustomBinaryName and CustomLongDescription #7513) (f283062)
• reverseproxy: Fix health_port being ignored in health checks (reverseproxy: Fix health_port being ignored in health checks #7533) (11b56c6)
• fix(caddyfile): Prevent parser to panic when no token were added by empty {block} (fix(caddyfile): Prevent parser to panic when no token were added by empty {block} #7543) (2dd3852)
• autohttps: Ensure CertMagic config is recreated after autohttps runs (autohttps: Ensure CertMagic config is recreated after autohttps runs #7510) (d935a69)
• logging: Ensure slog error level logs don't print stack traces (logging: Ensure slog error level logs don't print stack traces #7512) (45cf61b)
• proxyproto: Generated test coverage (proxyproto: Generated test coverage #7540) (a6acb39)
• core: Check whether @id is unique (caddy.go: Check whether @id is unique #7002) (7b34e31)
• api: Add all in-flight requests /reverse_proxy/upstreams (Fixes /reverse_proxy/upstreams - all in-flight requests #7277) (admin: Track reverse_proxy in-flight requests #7517) (88616e8)
• caddyhttp: Collect metrics once per route instead of per handler (perf: collect metrics once per route instead of per handler #7492) (dc36082)
• forward_auth: copy_headers does not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (forward_auth: copy_headers does not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) #7545) (2dbcdef)
• Merge commit from fork (7e83775)
• reverseproxy: Track dynamic upstreams, enable passive healthchecking (reverseproxy: Track dynamic upstreams, enable passive healthchecking #7539) (db29860)
• reverseproxy: prevent body close on dial-error retries (reverseproxy: prevent body close on dial-error retries #7547) (a5e7c6e)
• fileserver: document hide case-sensitivity (F-CADDY-FILESERVER-HIDE-CASE-001) (fileserver: document hide case-sensitivity (F-CADDY-FILESERVER-HIDE-CASE-001) #7548) (566e710)
• Update SECURITY.md (e06dfcf)
• rewrite: Force recomputing path when escaped path matches rewrite target (fbfb8fc)
• Wire up Cause for most context cancels (context: Wire up Cause for most context cancels #7538) (6e5e08c)
• build(deps): bump github.com/smallstep/certificates (build(deps): bump github.com/smallstep/certificates from 0.30.0-rc2.0.20260211214201-20608299c29c to 0.30.0-rc3 in the all-updates group #7535) (5d20adc)
• build(deps): bump the actions-deps group across 1 directory with 12 updates (build(deps): bump the actions-deps group across 1 directory with 12 updates #7536) (9371ee6)
• Revert cosign (see build(deps): bump the actions-deps group across 1 directory with 12 updates #7536) (ffb6ab0)

Release Checklist

• All tests pass
• Security review completed
• Documentation updated
• Breaking changes documented

---

Note: Tag creation is manual and requires a signed tag from a maintainer.

[github-actions]

✅ Approval Quorum Reached

This release proposal has been approved by 2 maintainers: @francislavoie, @mholt

Tagging Instructions

A maintainer should now create and push the signed tag:

git checkout ffb6ab0644f24c5ee6542aca6bd59b7a1b0a8f91
git tag -s v2.11.2 -m "Release v2.11.2"
git push origin v2.11.2
git checkout -

The release workflow will automatically start when the tag is pushed.

[github-actions]

🚀 Release Workflow Started

• Tag: v2.11.2
• Signed by key: +tijH5/rb2AXEwtxWzV3XtUZlfmJpAXA5Z9FMsCVwyo
• Commit: ffb6ab0
• Approved by: @francislavoie, @mholt

Release workflow is now running. This PR will be updated when the release is published.

[github-actions]

✅ Release Published

The release has been successfully published and is now available.