Important: Before upgrading, please review the migration guide for version 3.7.13.
Bug fixes
This maintenance release addresses several issues across ACME certificate management and TLS handling. The DNS-01 challenge no longer requires propagation of recursive nameservers by default, and recursive NSS propagation is now disabled by default as well, making certificate issuance more reliable in varied DNS environments. The underlying ACME library has been upgraded to go-acme/lego v5.4.1. Additionally, Traefik now correctly ignores negated matchers when parsing rule domains, redacts duplicate TLS certificates in provider merge logs, and downgrades the default TLS resources namespace mismatch log from an error to a warning.
For Kubernetes, Consul Catalog, and Nomad users, several provider-specific fixes are included. The Consul Catalog and Nomad providers now build collision-free item keys, preventing configuration conflicts. In the Kubernetes Ingress-Nginx integration, sticky cookie expiration is now calculated per request, HTTP redirect routers are created for SSL passthrough when force-ssl-redirect is set, and leading dots in sticky session cookie Domain attributes are preserved. On the server side, HTTP/3 connections now get a dedicated transport per client, h2c upgrade headers and request trailer values are no longer forwarded to backends, and requests with opaque target URIs are denied. The QUIC library has been bumped to v0.62.0, and configuration copies are now built once per change for improved performance.
Middleware, logging, and the web UI also received attention. Access log entries now have their level and time set before formatting the OTLP body, ensuring accurate telemetry. The customErrors middleware placeholder {url} now includes the correct scheme. Basic authentication no longer allows user enumeration through the singleflight cache key. Finally, the web UI now displays the correct number on details pages.
Documentation
Documentation updates include a warning about the frozen state of the Kubernetes Ingress API, removal of a misleading namespace reference for the providers.kubernetesGateway.labelSelector option, a fix for a broken redirect in the Kubernetes CRD reference docs, and guidance for scanning agents to read the security policy and decisions pages.
