发布日期: 2026-08-19
版本号: v3.7.11

Traefik 发布了 v3.7.11 版本，建议用户参考迁移指南。该版本修复了四个安全漏洞（CVE）。在 bug 修复方面，改进了 fastproxy 对后端状态码的处理，升级了 http3 相关依赖，修复了 Kubernetes CRD 提供器中的名称冲突和命名范围问题，优化了 Gateway API 的 URLRewrite 和 RequestRedirect 功能，解决了 ingress-nginx 提供器中的认证和配置问题，增强了 TLS 选项的灵活性，并升级了相关依赖。此外，文档也进行了更新，包括澄清访问日志中的状态码含义、修正 API 文档中的重复词汇、移除 Docker 配置中的只读限制、完善 Gateway API 和 ingress-nginx 的文档说明，以及添加中间件配置示例等。

更新内容 （中文）

重要提示： 请阅读迁移指南。

CVE已修复：

错误修复：

  • [fastproxy] 使用FastProxy时，拒绝来自后端的状态码超出范围的请求 (#13635 @gndz07)
  • [http3] 将 github.com/quic-go/quic-go 升级至 v0.61.0 (#13688 @jnoordsij)
  • [k8s/crd] 防止Kubernetes CRD提供程序中生成的名称冲突 (#13656 @rtribotte)
  • [k8s/crd] 添加一个选项以限制默认TLS资源的命名空间 (#13665 @rtribotte)
  • [k8s/crd] 在CRD提供程序中，将生成的Kubernetes Service名称限定在其父资源范围内 (#13668 @rtribotte)
  • [k8s/crd] 使故障转移生成的服务名称基于所引用的Kubernetes Service (#13677 @rtribotte)
  • [k8s/crd] 添加安全的命名选项以避免Kubernetes CRD提供程序中的冲突 (#13689 @gndz07)
  • [k8s/gatewayapi] 在Gateway API的URLRewrite和RequestRedirect中保留编码的路径段 (#13641 @gndz07)
  • [k8s/gatewayapi] 修复Gateway API路由规则 (#13645 @rtribotte)
  • [k8s/ingress-nginx] 为ingress-nginx提供程序去重共享主机的Ingress之间的client-auth TLS选项 (#13638 @gndz07)
  • [k8s/ingress-nginx] 将auth、custom-headers、custom errors和ssl-redirect应用于Ingress默认后端 (#13575 @rtribotte)
  • [k8s/ingress-nginx] 为ingress-nginx提供程序遵守asDefault并从默认选择中排除内部入口点 (#13629 @gndz07)
  • [k8s/ingress] 强制Kubernetes Ingress服务中间件遵循crossProviderNamespace (#13670 @gndz07)
  • [middleware, authentication] 将 github.com/containous/go-http-auth 升级至 b975dcaa8c48 (#13636 @kevinpollet)
  • [tls] 添加一个选项以禁用回退到默认TLS选项 (#13639 @rtribotte)
  • 升级 golang.org/x 依赖 (#13699 @mmatur)

文档：

  • [accesslogs] 在访问日志文档中阐明OriginStatus和DownstreamStatus (#13609 @rtribotte)
  • [api] 修复API/仪表板参考文档中的重复单词 (#13663 @latent-9)
  • [docker] 从docker.sock中移除:ro (#12656 @bluepuma77)
  • [k8s/gatewayapi] 阐明Gateway API 1.6.1的v3.7.10迁移指南 (#13628 @rtribotte)
  • [k8s/gatewayapi] 记录Kubernetes Gateway提供程序对实验性Channel CRDs的要求 (#13634 @rtribotte)
  • [k8s/ingress-nginx] 文档：更新支持的服务器片段指令 (#13687 @rtsui-harmonicinc)
  • [middleware] 在ipAllowList中间件配置示例中添加rejectStatusCode (#13664 @amazon7737)
  • [middleware] 将errors中间件的service选项标记为必需 (#13684 @lazerg)
  • [tls] 记录TLS选项冲突解决 (#13640 @rtribotte)
  • [tls] 阐明路由器TLS替换入口点TLS (#13630 @sornapudisuresh)
  • 记录Redis键空间通知要求 (#13691 @omkar619-dev)
  • 移除已退役的Go Report Card徽章 (#13637 @yardenshoham)
  • 恢复systemd套接字激活文档 (#13701 @lazerg)
  • 从v3.6开始更新版本支持策略 (#13627 @nmengin)

更新内容 （原始）

Important: Please read the migration guide.

CVE fixed:

Bug fixes:

  • [fastproxy] Reject out-of-range status codes from backends when using FastProxy (#13635 @gndz07)
  • [http3] Bump github.com/quic-go/quic-go to v0.61.0 (#13688 @jnoordsij)
  • [k8s/crd] Prevent generated name collisions in the Kubernetes CRD provider (#13656 @rtribotte)
  • [k8s/crd] Add an option to restrict the namespace of the default TLS resources (#13665 @rtribotte)
  • [k8s/crd] Scope generated Kubernetes Service names to their parent in the CRD provider (#13668 @rtribotte)
  • [k8s/crd] Name failover generated services after the referenced Kubernetes Service (#13677 @rtribotte)
  • [k8s/crd] Add safe naming option to avoid collisions for Kubernetes CRD provider (#13689 @gndz07)
  • [k8s/gatewayapi] Preserve encoded path segments in Gateway API URLRewrite and RequestRedirect (#13641 @gndz07)
  • [k8s/gatewayapi] Fix Gateway API router rules (#13645 @rtribotte)
  • [k8s/ingress-nginx] Dedupe client-auth TLS options across ingresses sharing a host for ingress-nginx provider (#13638 @gndz07)
  • [k8s/ingress-nginx] Apply auth, custom-headers, custom errors and ssl-redirect to ingress default backend (#13575 @rtribotte)
  • [k8s/ingress-nginx] Honor asDefault and exclude internal entrypoints from default selection for ingress-nginx provider (#13629 @gndz07)
  • [k8s/ingress] Enforce crossProviderNamespace for Kubernetes Ingress service middleware (#13670 @gndz07)
  • [middleware, authentication] Bump github.com/containous/go-http-auth to b975dcaa8c48 (#13636 @kevinpollet)
  • [tls] Add an option to disable the fallback to the default TLS options (#13639 @rtribotte)
  • Bump golang.org/x dependencies (#13699 @mmatur)

Documentation:

  • [accesslogs] Clarify OriginStatus and DownstreamStatus in access logs documentation (#13609 @rtribotte)
  • [api] Fix doubled word in API/dashboard reference docs (#13663 @latent-9)
  • [docker] Remove :ro from docker.sock (#12656 @bluepuma77)
  • [k8s/gatewayapi] Clarify v3.7.10 migration guide for Gateway API 1.6.1 (#13628 @rtribotte)
  • [k8s/gatewayapi] Document the Experimental Channel CRDs requirement of the Kubernetes Gateway provider (#13634 @rtribotte)
  • [k8s/ingress-nginx] Docs: Update supported server snippet directives (#13687 @rtsui-harmonicinc)
  • [middleware] Add rejectStatusCode to the ipAllowList middleware configuration example (#13664 @amazon7737)
  • [middleware] Mark the errors middleware service option as required (#13684 @lazerg)
  • [tls] Document the TLS options conflict resolution (#13640 @rtribotte)
  • [tls] Clarify router TLS replaces entrypoint TLS (#13630 @sornapudisuresh)
  • Document Redis keyspace notifications requirement (#13691 @omkar619-dev)
  • Remove retired Go Report Card badge (#13637 @yardenshoham)
  • Restore the systemd socket activation documentation (#13701 @lazerg)
  • Update version support policy starting with v3.6 (#13627 @nmengin)

下载链接