LoginSign Up
← Back to all sparks
T

Traefik

INFRA · APIS
Velocity5.0

Cloud-native reverse proxy and ingress controller with automatic service discovery

traefik.io ↗

The 2.11 branch is pure upkeep — two CVEs and a CONNECT rework in three weeks.

reverse-proxylts-branchcve-responsekubernetes-crdconnect-tunneling
◆Current state
Traefik's 2.11 line is on maintenance duty and every release in the window is either an advisory or a dependency bump. Two GHSA-tracked CVEs landed three weeks apart, and 2.11.53 reworked CONNECT handling — deferring the payload until the backend accepts the tunnel, and keeping CONNECT requests out of the connection pool — with a migration note attached because the behaviour change is visible to users.
◆Where it's heading
This is a long-term support branch behaving like one: security response, Kubernetes CRD correctness, and library currency across tracing, gRPC, compression and TLS dependencies. The one substantive change, the CONNECT rework, is a proxying-correctness fix rather than a feature, and the fact it needed a migration guide entry says the old behaviour was being relied on.
◆Prediction
Expect 2.11.x to keep producing small advisory-and-dependency releases at a two-to-three week cadence, with anything new landing on the newer major instead.

◆Recent moves

  1. 2d ago

    Dependency bumps and a Kubernetes CRD namespace check

    Four dependency updates across tracing, text, net and compression, plus a fix to the cross-namespace service reference check in the Kubernetes CRD provider. Routine LTS upkeep.

    View source ↗
  2. 6d ago

    CVE fix and CONNECT tunnel handling rework

    Fixes a GHSA advisory and changes how CONNECT is handled — the payload is deferred until the backend accepts the tunnel, and CONNECT requests no longer return to the connection pool. The migration note shipped alongside signals this is a behaviour change operators may notice.

    View source ↗
  3. 24d ago

    CVE fix and ReplacePathRegex path sanitization

    A second GHSA advisory in the window, with the replaced path in ReplacePathRegex now sanitized. Path handling in rewrite middleware is a recurring source of proxy security bugs and this fits the pattern.

    View source ↗