Traefik + Let's Encrypt

Important: Please read the migration guide.

CVE fixed:

• Advisory GHSA-5w68-77r2-r64c
• Advisory GHSA-g55h-rg46-x9c5
• Advisory GHSA-j994-9gqj-9hwq
• Advisory GHSA-m6wx-622r-48r9

Bug fixes:

• [fastproxy] Reject out-of-range status codes from backends when using FastProxy (#13635 @gndz07)
• [http3] Bump github.com/quic-go/quic-go to v0.61.0 (#13688 @jnoordsij)
• [k8s/crd] Prevent generated name collisions in the Kubernetes CRD provider (#13656 @rtribotte)
• [k8s/crd] Add an option to restrict the namespace of the default TLS resources (#13665 @rtribotte)
• [k8s/crd] Scope generated Kubernetes Service names to their parent in the CRD provider (#13668 @rtribotte)
• [k8s/crd] Name failover generated services after the referenced Kubernetes Service (#13677 @rtribotte)
• [k8s/crd] Add safe naming option to avoid collisions for Kubernetes CRD provider (#13689 @gndz07)
• [k8s/gatewayapi] Preserve encoded path segments in Gateway API URLRewrite and RequestRedirect (#13641 @gndz07)
• [k8s/gatewayapi] Fix Gateway API router rules (#13645 @rtribotte)
• [k8s/ingress-nginx] Dedupe client-auth TLS options across ingresses sharing a host for ingress-nginx provider (#13638 @gndz07)
• [k8s/ingress-nginx] Apply auth, custom-headers, custom errors and ssl-redirect to ingress default backend (#13575 @rtribotte)
• [k8s/ingress-nginx] Honor asDefault and exclude internal entrypoints from default selection for ingress-nginx provider (#13629 @gndz07)
• [k8s/ingress] Enforce crossProviderNamespace for Kubernetes Ingress service middleware (#13670 @gndz07)
• [middleware, authentication] Bump github.com/containous/go-http-auth to b975dcaa8c48 (#13636 @kevinpollet)
• [tls] Add an option to disable the fallback to the default TLS options (#13639 @rtribotte)
• Bump golang.org/x dependencies (#13699 @mmatur)

Documentation:

• [accesslogs] Clarify OriginStatus and DownstreamStatus in access logs documentation (#13609 @rtribotte)
• [api] Fix doubled word in API/dashboard reference docs (#13663 @latent-9)
• [docker] Remove :ro from docker.sock (#12656 @bluepuma77)
• [k8s/gatewayapi] Clarify v3.7.10 migration guide for Gateway API 1.6.1 (#13628 @rtribotte)
• [k8s/gatewayapi] Document the Experimental Channel CRDs requirement of the Kubernetes Gateway provider (#13634 @rtribotte)
• [k8s/ingress-nginx] Docs: Update supported server snippet directives (#13687 @rtsui-harmonicinc)
• [middleware] Add rejectStatusCode to the ipAllowList middleware configuration example (#13664 @amazon7737)
• [middleware] Mark the errors middleware service option as required (#13684 @lazerg)
• [tls] Document the TLS options conflict resolution (#13640 @rtribotte)
• [tls] Clarify router TLS replaces entrypoint TLS (#13630 @sornapudisuresh)
• Document Redis keyspace notifications requirement (#13691 @omkar619-dev)
• Remove retired Go Report Card badge (#13637 @yardenshoham)
• Restore the systemd socket activation documentation (#13701 @lazerg)
• Update version support policy starting with v3.6 (#13627 @nmengin)