Traefik 3.7.18 tightens authentication and path handling

Traefik, the open source reverse proxy and load balancer, released version 3.7.18 on 10 November. The release notes open with a request to read the migration guide before upgrading.

What changed in request handling

• Paths. Dot-segments and empty segments in paths that carry path parameters are now resolved. This is the change the migration note covers, because it can affect how existing routes match.
• Host matchers. Traefik now validates the values in HTTP Host matchers.
• Authentication. BasicAuth password length is now limited, and connection-bound authentication schemes are supported in Proxy-Authorization.

Other fixes

• The Compress middleware now caps zstd encoder memory and accepts an uppercase Q weight in Accept-Encoding.
• The Ingress NGINX compatibility provider applies CORS before redirect annotations and fixes client-certificate headers when Ingresses share a host.
• WASM plugins no longer get deterministic randomness, and the SPIFFE configuration for the TCP servers transport is fixed.