Traefik has released v3.6.25, a patch update focused on stability and security. This release resolves key issues in authentication flows, Kubernetes integrations, and bumps essential dependencies. Here's what you need to know.
Key Changes
- Authentication Singleflight Fix – The
[middleware, authentication]fix addresses a key collision in the singleflight mechanism used for authentication checks. This prevents unintended sharing of authentication results across different requests, improving security and correctness. - Kubernetes Gateway API Router Name Collisions – In the
[k8s/gatewayapi]provider, a fix (#13580) avoids router name collisions when multiple HTTP routes generate the same router names, ensuring predictable routing behavior. - Kubernetes CRD Cross-Namespace Reference – The
[k8s/crd]provider now correctly validates cross-namespace service references (#13573), preventing misconfigurations where services from other namespaces are incorrectly allowed or denied.
Dependency Updates
- ACME Library: Bumped
github.com/go-acme/lego/v5to v5.3.1 (#13547), which includes upstream bug fixes for ACME certificate issuance. - Datadog Tracing: Upgraded
github.com/DataDog/dd-trace-go/v2to v2.8.1 (#13530), improving tracing reliability. - Core Go Libraries: Bumped
golang.org/x/textto v0.40.0 andgolang.org/x/netto v0.57.0 (#13574), enhancing security and performance. - Compression: Updated
github.com/klauspost/compressto v1.18.7 (#13587), which brings performance improvements and bug fixes.
Why It Matters
For developers running Traefik in production, this patch ensures more reliable authentication behavior, especially where concurrent requests could have been incorrectly cached. The Kubernetes fixes are crucial for organizations using Gateway API or CRD providers, as they prevent routing misconfigurations that could lead to downtime or security holes. Dependency bumps also keep Traefik aligned with upstream security patches and performance gains.
Upgrading is straightforward—simply update your Traefik image to v3.6.25. As always, test in a staging environment first to confirm compatibility with your existing configuration.
Source: https://github.com/traefik/traefik/releases/tag/v3.6.25