Traefik v3.7.15 is a bug-fix release focused on HTTP request handling and Kubernetes integrations. The headline change is stricter rejection of CONNECT requests, applied before traffic reaches the router muxer, plus several Kubernetes provider corrections and a concurrency fix in FastProxy.
- [server] Reject CONNECT requests regardless of HTTP version, and reject the
CONNECTmethod before reaching the muxer, tightening the request path early in the pipeline. - [k8s/crd] Allow observability metadata on child routers, so nested route definitions can carry their own telemetry context.
- [k8s/gatewayapi] Bump
sigs.k8s.io/gateway-apito v1.6.3, and default the HTTPRoute backend scheme to HTTP when noappProtocolis set. - [k8s/ingress-nginx] Apply
auth-tlsclient authentication to the whole host, and fix the cross-namespace check on sharedauth-tls-secretTLS options. - [fastproxy] Fix concurrent buffer reads on upgraded connections, with a new non-regression test for CR/LF in FastProxy request headers.
- Dependencies bumped:
golang.org/x/netto v0.60.0. - Documentation fixes cover the Request Path security page, broken Kubernetes CRD definition links, and the
safeNamingimpact on cross-provider references.
The release notes point to a migration guide, so read it before upgrading.
For developers, the CONNECT rejections are the most consequential items: CONNECT is the HTTP method used for tunnelling, and rejecting it early reduces the surface available to misrouted or malicious requests without waiting on router matching. The FastProxy buffer fix matters for anyone relying on connection upgrades (WebSockets and similar), where concurrent reads could corrupt or drop data. The Gateway API and ingress-nginx changes reduce surprising behaviour when migrating Ingress resources, particularly around TLS client auth and cross-namespace secret sharing. Pin [email protected] if you depend on upgraded connections or Kubernetes Gateway API routes.
Source: https://github.com/traefik/traefik/releases/tag/v3.7.15