Breaking: Underscore headers silently dropped in v2.11.4 — no opt-out, no warning, no migration path

Unable to edit Cookie in logs

WebSocket header casing normalization reverted when header ops are configured

Dynamic named matchers not registered in Caddyfile

Consider including *some* event handlers by default

Fix available for `CVE-2026-34986` in `go-jose` `v3.0.5`

Dynamic http3 upstreams recieve untemplated sni

http.request.proto is wonky for HTTP/2 and HTTP/3 (there’s no such thing as “HTTP/2.0” or “HTTP/3.0”)

Feature: Allow using inode in ETags

~invalid Read on closed Body" when using reverse_proxy and error handler