Traefik v3.7.13 is a patch release that addresses several critical bugs across ACME, Kubernetes ingress-nginx, HTTP/3, and provider integrations. The most notable change is the backward-incompatible shift in DNS-01 challenge behavior: recursive nameserver propagation is now disabled by default, so users with strict firewall policies or split-horizon DNS should review the migration guide.
Key fixes in this release:
- ACME DNS-01: Bumped
github.com/go-acme/lego/v5to v5.4.1 (#13759) and disabled recursivensspropagation by default (#13830, #13710). This reduces false challenges, but custom DNS resolvers may need explicit configuration. - ACME/TLS routing: Ignore negated matchers when parsing rule domains (#13725), preventing unexpected certificate issuance or routing errors.
- Consul & Nomad providers: Collision-free item keys built for service discovery (#13741), fixing potential loss of configuration when multiple services share similar names.
- HTTP/3: Dedicated transport per client connection (#13812) resolves race conditions and improves connection stability under load.
- Kubernetes ingress-nginx: Fixed sticky cookie expiration per request (#13496), preserved leading dot in
Domainattribute (#13456), and created HTTP redirect router forssl-passthroughwithforce-ssl-redirect(#13457). These are subtle but crucial for session persistence and HTTPS enforcement. - Logging & middleware: Access log entry level and time are now set before OTLP body formatting (#13767). Also, TLS resource namespace mismatch logs downgraded from error to warning in k8s CRD (#13780).
- Custom errors middleware:
{url}placeholder now includes the correct URL with query parameters (#?—implied from description)
For developers running edge or production Traefik, this release emphasizes operational stability—especially for ACME DNS challenges and HTTP/3. If you rely on custom DNS servers or multi-cluster Kubernetes setups with sticky sessions, test upgrading carefully. The DNS propagation change may require explicit resolvers configuration in your DNSChallenge options. As always, check the changelog for full details.
Source: https://github.com/traefik/traefik/releases/tag/v3.7.13