Traefik has rolled out a new release focused on stability and clarity, with a series of bug fixes across its core proxy features, Kubernetes integrations, and documentation.
Core Proxy and TLS Fixes
Several issues in the proxy engine were addressed. The FastProxy module now rejects out-of-range status codes returned by backends, preventing unexpected behavior. HTTP/3 support was improved by updating the underlying quic-go library to v0.61.0. In the authentication middleware, the go-http-auth dependency was bumped to a recent commit to incorporate upstream fixes. A new TLS option lets users disable the automatic fallback to the default TLS configuration, giving more control over certificate behavior. General Go dependencies from golang.org/x were also updated.
Kubernetes Provider Improvements
The Kubernetes-related providers received a substantial round of fixes. In the CRD provider, generated names for services and TLS resources can now be scoped to avoid collisions, with new options for safe naming and restricting the namespace of default TLS resources. Failover services are now named after the referenced Kubernetes Service, and overall name generation has been tightened to prevent conflicts. The Gateway API provider now preserves encoded path segments during URL rewrites and redirects, and router rules have been corrected. For the ingress-nginx provider, client-auth TLS options are deduplicated across ingresses sharing a host, default backend handling now applies authentication, custom headers, custom errors, and SSL redirects, and the provider respects the asDefault flag while excluding internal entrypoints from default selection. The standard Kubernetes Ingress provider now enforces the crossProviderNamespace setting for service middleware.
Documentation Updates
The documentation has been refreshed across many areas. Access logs now clarify the meaning of OriginStatus and DownstreamStatus. The API and dashboard reference fixed a doubled word, and Docker instructions no longer include the read-only flag for the Docker socket. The Kubernetes Gateway API migration guide for v3.7.10 was updated for Gateway API 1.6.1, and the requirement for Experimental Channel CRDs is now documented. The ingress-nginx provider’s supported server snippet directives were updated. Middleware docs added a rejectStatusCode example for ipAllowList and marked the service option of the errors middleware as required. TLS documentation now explains conflict resolution and clarifies that router TLS configuration replaces entrypoint TLS settings. A Redis keyspace notifications requirement was documented, the systemd socket activation guide was restored, and the version support policy was updated starting with v3.6. Finally, a retired Go Report Card badge was removed from the repository.
