dependabot[bot] opened a new pull request, #33: URL: https://github.com/apache/casbin-caddy-authz/pull/33
Bumps [github.com/caddyserver/caddy/v2](https://github.com/caddyserver/caddy) from 2.11.2 to 2.11.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/caddyserver/caddy/releases";>github.com/caddyserver/caddy/v2's releases</a>.</em></p> <blockquote> <h2>v2.11.3</h2> <p>This release improves several aspects of Caddy with minor features, bug fixes, and security patches. Thank you to everyone and their bots who contributed to help make this release the best one yet!</p> <p><strong>Security patches:</strong></p> <ul> <li>fastcgi: Carrying over a patch from FrankenPHP for a bug that could allow non-PHP files to be executed; collaborated on by <a href="https://github.com/dunglas";><code>@dunglas</code></a>, <a href="https://github.com/KC1zs4";><code>@KC1zs4</code></a>, and <a href="https://github.com/chenjj";><code>@chenjj</code></a>.</li> <li>vars: A more thorough fix for <a href="https://github.com/advisories/GHSA-m2w3-8f23-hxxf";>https://github.com/advisories/GHSA-m2w3-8f23-hxxf</a>, collaborated by <a href="https://github.com/everping";><code>@everping</code></a> and <a href="https://github.com/vnxme";><code>@vnxme</code></a>.</li> <li>admin: Array index normalization to prevent remote admin socket auth bypass, by <a href="https://github.com/Amemoyoi";><code>@Amemoyoi</code></a> and bot.</li> <li>admin: More rigorous path prefix matching to prevent remote admin socket auth bypass, by <a href="https://github.com/Amemoyoi";><code>@Amemoyoi</code></a> and bot.</li> </ul> <p>We've also merged a couple PRs that fix upstream security bugs in other projects like quic-go and CertMagic. Thank you to <a href="https://github.com/marten-seemann";><code>@marten-seemann</code></a> for maintaining quic-go so diligently!</p> <h2>What's Changed</h2> <ul> <li>caddyhttp: Sync placeholder expansion in <code>vars</code> and <code>vars_regexp</code> by <a href="https://github.com/vnxme";><code>@vnxme</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7573";>caddyserver/caddy#7573</a></li> <li>caddytls: Avoid ACME fallback for implicit Tailscale *.ts.net policies by <a href="https://github.com/steadytao";><code>@steadytao</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7577";>caddyserver/caddy#7577</a></li> <li>chore: Resolve recent CI failures by <a href="https://github.com/mholt";><code>@mholt</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7593";>caddyserver/caddy#7593</a></li> <li>caddytls: Consolidate empty APs more smartly by <a href="https://github.com/mholt";><code>@mholt</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7567";>caddyserver/caddy#7567</a></li> <li>rewrite: skip query rename when source key is absent by <a href="https://github.com/steadytao";><code>@steadytao</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7599";>caddyserver/caddy#7599</a></li> <li>root: introduce down-propagating Helper.BlockState for other directives/plugins to use by <a href="https://github.com/henderkes";><code>@henderkes</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7594";>caddyserver/caddy#7594</a></li> <li>http: make zstd checksum configurable by <a href="https://github.com/ottenhoff";><code>@ottenhoff</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7586";>caddyserver/caddy#7586</a></li> <li>notify: Always send "READY=1" even after an error by <a href="https://github.com/francislavoie";><code>@francislavoie</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7597";>caddyserver/caddy#7597</a></li> <li>reverseproxy: Fix check for <code>header_up Host {upstream_hostport}</code> redundancy by <a href="https://github.com/yubiuser";><code>@yubiuser</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7564";>caddyserver/caddy#7564</a></li> <li>caddytls: Expand placeholders in dns_challenge override_domain tls parameter by <a href="https://github.com/pberkel";><code>@pberkel</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7609";>caddyserver/caddy#7609</a></li> <li>tls: add system and combined CA pool modules by <a href="https://github.com/HarshPatel5940";><code>@HarshPatel5940</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7406";>caddyserver/caddy#7406</a></li> <li>vars: Don't expand placeholders in values by <a href="https://github.com/vnxme";><code>@vnxme</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7629";>caddyserver/caddy#7629</a></li> <li>build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.42.0 to 1.43.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/caddyserver/caddy/pull/7637";>caddyserver/caddy#7637</a></li> <li>build(deps): bump the all-updates group across 1 directory with 11 updates by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/caddyserver/caddy/pull/7641";>caddyserver/caddy#7641</a></li> <li>reverseproxy: make stream copy buffer size configurable by <a href="https://github.com/steadytao";><code>@steadytao</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7627";>caddyserver/caddy#7627</a></li> <li>vars: Add matcher placeholder handling tests by <a href="https://github.com/steadytao";><code>@steadytao</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7640";>caddyserver/caddy#7640</a></li> <li>build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/caddyserver/caddy/pull/7621";>caddyserver/caddy#7621</a></li> <li>logging: Add journald encoder wrapper by <a href="https://github.com/steadytao";><code>@steadytao</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7623";>caddyserver/caddy#7623</a></li> <li>caddyfile: Improve import/global options UX for imports before global options by <a href="https://github.com/steadytao";><code>@steadytao</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7642";>caddyserver/caddy#7642</a></li> <li>chore: replace <code>interface{}</code> with <code>any</code> for modernization by <a href="https://github.com/tsinglua";><code>@tsinglua</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7571";>caddyserver/caddy#7571</a></li> <li>chore: bump timberjack to v1.4.1 by <a href="https://github.com/DeRuina";><code>@DeRuina</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7618";>caddyserver/caddy#7618</a></li> <li>logging: Preserve ts for journald-wrapped JSON logs by <a href="https://github.com/steadytao";><code>@steadytao</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7644";>caddyserver/caddy#7644</a></li> <li>fileserver: show symlink targets verbatim (<a href="https://redirect.github.com/caddyserver/caddy/issues/7476";>#7476</a>) by <a href="https://github.com/maxtruxa";><code>@maxtruxa</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7579";>caddyserver/caddy#7579</a></li> <li>fix(caddyfile): {block} in snippet by <a href="https://github.com/prettysunflower";><code>@prettysunflower</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7558";>caddyserver/caddy#7558</a></li> <li>caddyhttp: Document missing placeholders for escaped URI and prefixed query by <a href="https://github.com/steffenbusch";><code>@steffenbusch</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7659";>caddyserver/caddy#7659</a></li> <li>chore: add <code>AGENTS.md</code> by <a href="https://github.com/mohammed90";><code>@mohammed90</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7652";>caddyserver/caddy#7652</a></li> <li>build(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/caddyserver/caddy/pull/7655";>caddyserver/caddy#7655</a></li> <li>admin: Redact sensitive request headers in API logs by <a href="https://github.com/steadytao";><code>@steadytao</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7578";>caddyserver/caddy#7578</a></li> <li>reverseproxy: add <code>lb_retry_match</code> condition on response status by <a href="https://github.com/seroperson";><code>@seroperson</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7569";>caddyserver/caddy#7569</a></li> <li>caddyhttp: prefer port 443 in auto-HTTPS and add tests by <a href="https://github.com/mholt";><code>@mholt</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7666";>caddyserver/caddy#7666</a></li> <li>fix: Propagate ECH keys to the QUIC listener by <a href="https://github.com/steadytao";><code>@steadytao</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7670";>caddyserver/caddy#7670</a></li> <li>chore: Use atomics where appropriate by <a href="https://github.com/francislavoie";><code>@francislavoie</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7648";>caddyserver/caddy#7648</a></li> <li>metrics: Implement pushing via OLTP by <a href="https://github.com/dunglas";><code>@dunglas</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7664";>caddyserver/caddy#7664</a></li> <li>logging: Add regression coverage for rotated file mode by <a href="https://github.com/steadytao";><code>@steadytao</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7620";>caddyserver/caddy#7620</a></li> <li>httpcaddyfile: Inherit global ACME issuer settings in tls shortcuts by <a href="https://github.com/steadytao";><code>@steadytao</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7617";>caddyserver/caddy#7617</a></li> <li>build(deps): bump github.com/jackc/pgx/v5 from 5.9.0 to 5.9.2 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/caddyserver/caddy/pull/7668";>caddyserver/caddy#7668</a></li> <li>admin: require path segment boundary in remote access control by <a href="https://github.com/Amemoyoi";><code>@Amemoyoi</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7673";>caddyserver/caddy#7673</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/caddyserver/caddy/commit/cc58caa1099240ef1a4c280b892260b380a85c86";><code>cc58caa</code></a> go.mod: Upgrade quic-go to v0.59.1</li> <li><a href="https://github.com/caddyserver/caddy/commit/d80774cb3fe6abcd0fea9dd0c68812ee94c7cf2a";><code>d80774c</code></a> metrics: Add nil check for metricsHandler in AdminMetrics.serveHTTP (<a href="https://redirect.github.com/caddyserver/caddy/issues/7553";>#7553</a>)</li> <li><a href="https://github.com/caddyserver/caddy/commit/a4a38c3e88952a361c6e44c5dc3200bba1497e15";><code>a4a38c3</code></a> rewrite: escape file matcher paths before rewriting (<a href="https://redirect.github.com/caddyserver/caddy/issues/7683";>#7683</a>)</li> <li><a href="https://github.com/caddyserver/caddy/commit/761347aa635e14bf7a937e88d45a40e671d325c5";><code>761347a</code></a> templates: Explicitly warn about misconfigurations</li> <li><a href="https://github.com/caddyserver/caddy/commit/4ba16fe82c9dbf8affb670dc56f7c43f1296e3e9";><code>4ba16fe</code></a> docs: add documentation for fileExists and fileStat template functions (<a href="https://redirect.github.com/caddyserver/caddy/issues/7700";>#7700</a>)</li> <li><a href="https://github.com/caddyserver/caddy/commit/0fab9f0f7db04fdb0c1c3113d51e7c420d3c8f06";><code>0fab9f0</code></a> caddytls: avoid duplicate automation for wildcard-covered hosts (<a href="https://redirect.github.com/caddyserver/caddy/issues/7697";>#7697</a>)</li> <li><a href="https://github.com/caddyserver/caddy/commit/5e76b5ee43e8ec9e78d07665cdd75515b4c07acd";><code>5e76b5e</code></a> tls: add alpn to managed HTTPS records (<a href="https://redirect.github.com/caddyserver/caddy/issues/7653";>#7653</a>)</li> <li><a href="https://github.com/caddyserver/caddy/commit/9c78b97f9e79773d45cf3ad0326bfb5480861ac0";><code>9c78b97</code></a> fastcgi: Fix lint</li> <li><a href="https://github.com/caddyserver/caddy/commit/fb324331f40782ac7a48d83f591c2bb7615d7eed";><code>fb32433</code></a> Merge commit from fork</li> <li><a href="https://github.com/caddyserver/caddy/commit/0780d4489cc7199b87598b15aad3270e851ac138";><code>0780d44</code></a> httpcaddyfile: accept duration strings for log sampling interval (<a href="https://redirect.github.com/caddyserver/caddy/issues/7694";>#7694</a>)</li> <li>Additional commits viewable in <a href="https://github.com/caddyserver/caddy/compare/v2.11.2...v2.11.3";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/casbin-caddy-authz/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
