Update module github.com/caddyserver/caddy/v2 to v2.10.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/caddyserver/caddy/v2	v2.10.0 → v2.10.2

---

Release Notes

caddyserver/caddy (github.com/caddyserver/caddy/v2)

v2.10.2

Compare Source

This is a hotfix release to fix a couple critical issues from v2.10.1

What's Changed

• http: Make logger first, before TLS provisioning by @​francislavoie in #​7198
• httpcaddyfile: Fix acme_dns regression by @​francislavoie in #​7199
• caddyfile: Fix importing nested tokens for {block} by @​BeeJay28 in #​7189

Changelog

• 551f793 caddyfile: Fix importing nested tokens for {block} (#​7189)
• 16fe83c http: Make logger first, before TLS provisioning (#​7198)
• 4564261 httpcaddyfile: Fix acme_dns regression (#​7199)

New Contributors

• @​BeeJay28 made their first contribution in #​7189

Full Changelog: caddyserver/caddy@v2.10.1...v2.10.2

v2.10.1

Compare Source

This is probably our biggest patch release ever -- not that lots of things were broken, but there's lots of refinement happening thanks to broader adoption and contributions from many more people. Just look at the New Contributors below!

Anyway, this release does contain some bug fixes and dependency upgrades which we hope will serve you well. Let us know if there's any issues! And thank you to all who contributed, especially our reliable maintainer team!

This version of Caddy requires Go v1.25.0 or newer.

What's Changed

• update quic-go to v0.51.0 by @​marten-seemann in #​6972
• forwardproxy: reference correct field name in LoadModule by @​mohammed90 in #​6978
• fix: Remove nil arg from zapslog.NewHandler call by @​IndraGunawan in #​6984
• fileserver: Add support for .avif image format by @​steffenbusch in #​6988
• reverseproxy: use DialTLSContext for TLS if servername has placeholder by @​WeidiDeng in #​6955
• admin: Make sure that any admin routers are provisioned when local/re… by @​Compy in #​6997
• log: default logger should respect {in,ex}clude by @​mohammed90 in #​6995
• Move local admin server replacement logic below data structure initia… by @​Compy in #​7004
• acme_server: fix policy parsing in caddyfile by @​mohammed90 in #​7006
• implement Unwrap for interceptedResponseHandler by @​WeidiDeng in #​7016
• fileserver: map invalid path errors to fs.ErrInvalid, and return 400 … by @​Compy in #​7017
• caddyhttp: fix route sort by comparing paths without wildcard if they don't shar… by @​WeidiDeng in #​7015
• refactor: use maps.Copy for cleaner map handling by @​eveneast in #​7009
• refactor: use slices.Contains to simplify code by @​tongjicoder in #​7039
• chore: upgrade .golangci.yml and workflow to v2 by @​mohammed90 in #​6924
• build(deps): bump golangci/golangci-lint-action from 6 to 8 by @​dependabot[bot] in #​7044
• fix: crash - null check on event origin by @​suxatcode in #​7047
• fix: prevent error handler from overriding sub handler matchers by @​Hellio404 in #​6999
• client_auth: wire up leaf verifier Caddyfile by @​mohammed90 in #​6772
• caddyfile: reject blocks in log_skip directive by @​IwatsukaYura in #​7056
• build(deps): bump github.com/cloudflare/circl from 1.6.0 to 1.6.1 by @​dependabot[bot] in #​7058
• cmd: fix Commands function not returning all registered commands by @​hslatman in #​7059
• ci: add dep review, OSSF scorecard actions by @​mohammed90 in #​7063
• ci: add {base,head}-ref to dep review check by @​mohammed90 in #​7064
• core: clean up new config if it failed to run by @​WeidiDeng in #​7068
• chore: apply security best practices for CI by @​mohammed90 in #​7066
• refactor: use the built-in max/min to simplify the code by @​xiaoxiangirl in #​7081
• [ADD] sort buttons in grid mode by @​filipRatajczak in #​7089
• update quic-go to v0.53.0 by @​marten-seemann in #​7094
• refactor: replace HasPrefix+TrimPrefix with CutPrefix by @​gopherorg in #​7095
• docs: fix some minor issues in the comments by @​mountdisk in #​7101
• httpcaddyfile: Validates TLS DNS challenge options by @​francislavoie in #​7099
• chore: fix struct name in comment by @​bytetigers in #​7114
• reverse proxy: validate versions in http transport by @​WeidiDeng in #​7112
• chore: fix function in comment by @​bytesingsong in #​7121
• Fix: Support placeholders in header replacement search patterns by @​zongzewu23 in #​7117
• fileserver: specify license for embedded JavaScript by @​infertux in #​7127
• fix dead link by @​eeemmmmmm in #​7136
• update quic-go to v0.54.0 by @​marten-seemann in #​7138
• chore: fix minor issue in comment by @​pingshuijie in #​7140
• refactor: use slices.Equal to simplify code by @​minxinyi in #​7141
• ci: reduce dependabot spam by @​mohammed90 in #​7078
• fix(provisioning): Context.App or Context.AppIfConfigured will return (val, nil) even if the app failed to provision or validate the first time by @​alexandre-daubois in #​7070
• build(deps): bump the actions-deps group with 6 updates by @​dependabot[bot] in #​7142
• Use KeepAliveConfig to pass keepalive_interval to listener's accepted sockets by @​joshuamcbeth in #​7151
• build(deps): bump the all-updates group across 1 directory with 17 updates by @​dependabot[bot] in #​7155
• cmd: Allow caddy adapt to read from stdin by @​bosdhill in #​7163
• feat: add bcrypt cost parameter to hash-password by @​GreyXor in #​7149
• fix typo in bcrypt cost flag name by @​GreyXor in #​7168
• chore: fix inconsistent function name in comment by @​youzichuan in #​7174
• caddytls: fix regression in external certificate manager support by @​quagsirus in #​7179
• http: free up quic listener when stopping by @​WeidiDeng in #​7177
• chore: bump Go to v1.25 by @​dunglas in #​7184
• caddyhttp: refactor to use reflect.TypeFor by @​cuiweixie in #​7187
• refactor: use a more modern writing style to simplify code by @​joemicky in #​7182
• http: disable keepalive when KeepAliveInterval is negative by @​WeidiDeng in #​7158
• http: clean up listeners if some of the listeners fail to bind by @​WeidiDeng in #​7176
• reverse_proxy: use the new KeepAliveConfig to set probe interval by @​WeidiDeng in #​7157
• ci: set proper build tags in golangci and minor cleanup by @​dunglas in #​7183
• doc: Add a few lines about Etag file content by @​Pizmovc in #​7173
• file_server: set Range header for precompressed static files to force Content Length header to appear by @​WeidiDeng in #​7042
• caddyhttp: use the new http.Protocols to handle h1, h2 and h2c requests by @​WeidiDeng in #​6961

Changelog

• 44d078b acme_server: fix policy parsing in caddyfile (#​7006)
• 320c572 admin: Make sure that any admin routers are provisioned when local/re… (#​6997)
• 49dac61 bcrypt: add cost parameter to hash-password (#​7149)
• 4bfc3b9 bcrypt: wrong cost flag name (#​7168)
• 4b01d77 build(deps): bump github.com/cloudflare/circl from 1.6.0 to 1.6.1 (#​7058)
• 45c9341 build(deps): bump golangci/golangci-lint-action from 6 to 8 (#​7044)
• 5bc2afb build(deps): bump the actions-deps group with 6 updates (#​7142)
• 007f406 build(deps): bump the all-updates group across 1 directory with 17 updates (#​7155)
• 8524386 caddyhttp: Compare paths w/o wildcard if prefixes differ (#​7015)
• 7590c9c caddyhttp: Free up quic listener when stopping (#​7177)
• b15ed9b caddyhttp: refactor to use reflect.TypeFor (#​7187)
• 14a63a2 caddyhttp: use the new http.Protocols to handle h1, h2 and h2c requests (#​6961)
• 731e6c2 caddytls: Improve ECH error logging (close #​7152)
• 105eee6 caddytls: Set local_ip, not remote_ip (#​6952)
• b898873 caddytls: fix regression in external certificate manager support (#​7179)
• 1481c04 caddytls: wire up client_auth leaf verifier Caddyfile (#​6772)
• 19ff47a cmd: Allow caddy adapt to read from stdin (#​7163)
• e633d01 cmd: fix Commands function not returning all registered commands (#​7059)
• 7099892 core: Check for nil event origin (#​7047)
• 3d0b4fa core: Clean up new config if it failed to run (#​7068)
• 051e73a core: Replace admin server later in provisionContext (#​7004)
• fe41ff3 core: Save app provisioning errors with context (#​7070)
• e4447c4 core: Use KeepAliveConfig to pass keepalive_interval to listener's accepted sockets (#​7151)
• b9710c6 fileserver: Add a few doc lines about Etag file content (#​7173)
• 3b4d966 fileserver: Add sort buttons in grid mode (#​7089)
• 54d03ce fileserver: Add support for .avif image format (#​6988)
• 790f3e0 fileserver: denote license for embedded JavaScript for LibreJS (#​7127)
• 94147ca fileserver: map invalid path errors to fs.ErrInvalid, and return 400 for any invalid path errors. (close #​7008) (#​7017)
• 67debd0 fileserver: set Range header for precompressed static files to force Content Length header to appear (#​7042)
• 89ed5f4 fix: Remove nil arg from zapslog.NewHandler call (#​6984)
• 3723e89 go.mod: Upgrade CertMagic to v0.24.0
• 3bd4135 go.mod: Upgrade dependencies
• a6d488a go.mod: update quic-go to v0.51.0 (#​6972)
• 11c6dae go.mod: update quic-go to v0.53.0 (#​7094)
• bbf1dfc headers: Support placeholders in replacement search patterns (#​7117)
• f11c780 http: clean up listeners if some of the listeners fail to bind (#​7176)
• fdf6108 http: disable keepalive when KeepAliveInterval is negative (#​7158)
• 5b727bd httpcaddyfile: Allow naked acme_dns if dns is set (fix #​7091)
• 0badb07 httpcaddyfile: Fix generated config related to ACME global options
• 092913a httpcaddyfile: Prevent error handler from overriding sub-handler matchers (#​6999)
• 77dd12c httpcaddyfile: Validates TLS DNS challenge options (#​7099)
• 0f209f6 httpcaddyfile: reject blocks in log_skip directive (#​7056)
• 716d72e intercept: implement Unwrap for interceptedResponseHandler (#​7016)
• 9f71483 log: default logger should respect {in,ex}clude (#​6995)
• 33c88bd refactor: replace HasPrefix+TrimPrefix with CutPrefix (#​7095)
• ab3b2d6 refactor: use slices.Equal to simplify code (#​7141)
• 1c596e3 reverse_proxy: use the new KeepAliveConfig to set probe interval (#​7157)
• aa3d20b reverseproxy: Use DialTLSContext if ServerName has placeholder (#​6955)
• 737936c reverseproxy: reference correct field name in LoadModule (#​6978)
• 1209b5c reverseproxy: validate versions in http transport (#​7112)

New Contributors

• @​IndraGunawan made their first contribution in #​6984
• @​Compy made their first contribution in #​6997
• @​eveneast made their first contribution in #​7009
• @​tongjicoder made their first contribution in #​7039
• @​suxatcode made their first contribution in #​7047
• @​Hellio404 made their first contribution in #​6999
• @​IwatsukaYura made their first contribution in #​7056
• @​xiaoxiangirl made their first contribution in #​7081
• @​filipRatajczak made their first contribution in #​7089
• @​gopherorg made their first contribution in #​7095
• @​mountdisk made their first contribution in #​7101
• @​bytetigers made their first contribution in #​7114
• @​bytesingsong made their first contribution in #​7121
• @​zongzewu23 made their first contribution in #​7117
• @​infertux made their first contribution in #​7127
• @​eeemmmmmm made their first contribution in #​7136
• @​pingshuijie made their first contribution in #​7140
• @​minxinyi made their first contribution in #​7141
• @​alexandre-daubois made their first contribution in #​7070
• @​joshuamcbeth made their first contribution in #​7151
• @​bosdhill made their first contribution in #​7163
• @​GreyXor made their first contribution in #​7149
• @​youzichuan made their first contribution in #​7174
• @​quagsirus made their first contribution in #​7179
• @​cuiweixie made their first contribution in #​7187
• @​joemicky made their first contribution in #​7182
• @​Pizmovc made their first contribution in #​7173

Full Changelog: caddyserver/caddy@v2.10.0...v2.10.1

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

This change is 

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Note

Free review on us!

CodeRabbit is offering free reviews until Wed Dec 17 2025 to showcase some of the refinements we've made.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Please retry analysis of this Pull-Request directly on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Please retry analysis of this Pull-Request directly on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud