Bug fixes:

• [server] Print access logs for rejected requests and warn about new behavior (#12426 by rtribotte)

Documentation:

• Clarify doc about encoded characters rejection (#12391 by rtribotte)
• Fix encoded characters entryPoint option documentation (#12384 by rtribotte)
• Fix encoded characters option documentation (#12373 by kevinpollet)

Bug fixes:

• [k8s/ingress-nginx] Fix NGINX sslredirect annotation support (#12387 by rtribotte)
• [server] Print access logs for rejected requests and warn about new behavior (#12424 by kevinpollet)

Documentation:

• [k8s/ingress-nginx] Add auth-signin to unsupported nginx annotations list (#12370 by fibsifan)
• Add a Breaking change note to the changelog (#12398 by nmengin)
• Fix encodedCharacters entryPoint option documentation (#12385 by rtribotte)

CVE's fixed:

• CVE-2025-66490 (Advisory GHSA-gm3x-23wp-hc2c): Breaking Change please read the migration guide.
• CVE-2025-66491 (Advisory GHSA-7vww-mvcr-x6vj)

Important: Please read the migration guide.

Bug fixes:

• [server] Reject suspicious encoded characters (#12360 by rtribotte)
• [plugins] Validate plugin module name (#12291 by kevinpollet)
• [http3] Bump github.com/quic-go/quic-go to v0.57.1 (#12319 by GreyXor)
• [http3] Bump github.com/quic-go/quic-go to v0.57.0 (#12308 by GreyXor)
• [server] Bump golang.org/x/crypto to v0.45.0 (#12296 by kevinpollet)
• [acme] Bump github.com/go-acme/lego/v4 to v4.29.0 (#12333 by ldez)
• [k8s/ingress-nginx] Fix SSL redirect to match NGINX behavior (#12361 by mmatur)
• [k8s/ingress-nginx] Fix the service name for ingress-nginx provider (#12352 by mmatur)
• [k8s/ingress-nginx] Fix nginx.ingress.kubernetes.io/proxy-ssl-verify annotation support (#12351 by rtribotte)
• [middleware,authentication] Change ForwardAuth error log level from DEBUG to ERROR (#12324 by murataslan1)

Documentation:

• [api] Fix typo in API dashboard configuration instructions (#12335 by NAICOLAS)
• [docker] Add documentation for loadbalancer.server.url in Docker and Swarm providers (#12289 by webash)
• [k8s/gatewayapi] Fix links of Helm chart values reference to providers.kubernetesGateway.enabled (#12315 by shouhei)
• [k8s/ingress-nginx] Fix default value of ingress-nginx provider in documentation (#12328 by mloiseleur)
• [k8s/ingress-nginx] NGINX Ingress Controller to Traefik Migration Guide (#12318 by sheddy-traefik)
• [k8s/ingress-nginx] Improve the configuration options display of the Kubernetes ingress-nginx provider (#12297 by mloiseleur)
• [k8s/ingress-nginx] Improve ingress-nginx provider documentation (#12288 by sheddy-traefik)
• [service] Fix loadbalancer doc for highest random weight (#12283 by ozon2)
• Correctly Format the HTTP Service Documentation (#12311 by sheddy-traefik)
• Add documentation about checkNewVersion (#12298 by darkweaver87)

Misc:

• Merge branch v2.11 into v3.6 (#12364 by kevinpollet)
• Merge branch v2.11 into v3.6 (#12341 by mmatur)
• Merge branch v2.11 into v3.6 (#12368 by mmatur)

CVE's fixed:

• CVE-2025-66490 (Advisory GHSA-gm3x-23wp-hc2c): Breaking Change please read the migration guide.

Important: Please read the migration guide.

Bug fixes:

• [server] Reject suspicious encoded characters (#12360 by rtribotte)
• [plugins] Validate plugin module name (#12291 by kevinpollet)
• [http3] Bump github.com/quic-go/quic-go to v0.57.1 (#12319 by GreyXor)
• [http3] Bump github.com/quic-go/quic-go to v0.57.0 (#12308 by GreyXor)
• [server] Bump golang.org/x/crypto to v0.45.0 (#12296 by kevinpollet)

Documentation:

• Update SECURITY.md to streamline information (#12310 by emilevauge)
• Update SECURITY.md (#12304 by cwayne18)

Important: Please read the migration guide.

Bug fixes:

• [k8s/ingress-nginx] Deprecate Kubernetes Ingress NGINX provider experimental flag (#12286 by rtribotte)

Important: Please read the migration guide.

Bug fixes:

• [docker] Auto-negotiate Docker API Version (#12256 by felixbuenemann)
• [server] Fix multi-layer routing with models (#12258 by juliens)
• [udp] Revert "Avoid allocations in readLoop by using sync.Pool" (#12267 by kevinpollet)
• [webui] Fix blocked navigation on Safari (#12231 by gndz07)
• [webui] Restore remote Upgrade to Hub button web component (#12219 by gndz07)

Documentation:

• [k8s] Fix Nginx provider documentation (#12266 by nmengin)
• [k8s] Fix Gateway API version and the list of features supported (#12254 by nmengin)

Bug fixes:

• [docker,docker/swarm] Auto-negotiate Docker API version (#12262 by kevinpollet)

Important: Please read the migration guide.

Enhancements:

• [acme] Add new certificatesresolvers options (#11977 by ldez)
• [consul,consulcatalog,nomad] Log provider namespace during startup (#12002 by shreealt)
• [docker] Allow discovering non-running Docker containers (#10645 by acouvreur)
• [ecs] AWS ECS IPv6 Support (#12179 by wizbit)
• [file,k8s/crd,service] Add least time load balancing strategy (#12167 by sdelicata)
• [healthcheck,tcp] Add TCP Healthcheck (#11238 by ddtmachado)
• [healthcheck] Add passive health checks (#11351 by Nelwhix)
• [k8s/crd] Add highest random weight in Kubernetes CRD (#12061 by lbenguigui)
• [k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.4.0 (#12140 by kevinpollet)
• [k8s/ingress] Allow publishing services with type ExternalName (#12065 by james-callahan)
• [k8s] Add Knative provider (#11448 by idurgakalyan)
• [middleware,authentication] Add warning when maxBodySize is not set (#12085 by kianelbo)
• [middleware,server] Multi-layer routing (#12130 by sdelicata)
• [plugins] Support syscall (#11939 by david-garcia-garcia)
• [server] Implement HTTP2 HPACK table size options (#12050 by GCHQDeveloper548)
• [service,udp] Avoid allocations in readLoop by using sync.Pool (#12029 by arturmelanchyk)
• [service] Add HighestRandomWeight load balancing algorithm (#9946 by mathieuHa)
• [webui] Add Traefik Hub demo in dashboard (#12193 by gndz07)
• [webui] Reduce vertical padding in dashboard table rows for more compact layout (#12145 by leccelecce)

Bug fixes:

• [server] Make the aggregator compute provider namespace for router's parentRefs (#12235 by rtribotte)

Documentation:

• Prepare release v3.6.0-rc1 (#12211 by kevinpollet)
• Fix broken link to migration guide on readme (#12021 by 0slb)
• Fix broken links in TCP Service and HTTP Router documentation (#12215 by sheddy-traefik)
• Fix typo in v3.6 migration guide (#12212 by jnoordsij)

Misc:

• Merge branch v3.5 into master (#12210 by rtribotte)
• Merge branch v3.5 into master (#12191 by rtribotte)
• Merge branch v3.5 into master (#12188 by rtribotte)
• Merge branch v3.5 into master (#12160 by rtribotte)
• Merge branch v3.5 into master (#12136 by kevinpollet)
• Merge branch v3.5 into master (#12120 by rtribotte)
• Merge branch v3.5 into master (#12095 by kevinpollet)
• Merge branch v3.5 into master (#12051 by rtribotte)
• Merge branch v3.5 into master (#11976 by kevinpollet)
• Merge branch v3.5 into master (#11940 by kevinpollet)
• Merge branch v3.5 into master (#11900 by kevinpollet)
• Merge branch v3.5 into v3.6 (#12242 by kevinpollet)

Bug fixes:

• [acme] Bump github.com/go-acme/lego/v4 to v4.28.0 (#12218 by ldez)
• [server] Filter unknown nodes with file and env for the deprecation loader (#12227 by rtribotte)

Documentation:

• [acme] Add missing ACME options and clean up table for more visibility (#12208 by sheddy-traefik)
• [middleware] Fix default encodings in compress middleware (#12216 by Belphemur)
• Update Configuration Overview Page (#12202 by sheddy-traefik)

Important: Please read the migration guide.

Enhancements:

• [acme] Add new certificatesresolvers options (#11977 by ldez)
• [consul,consulcatalog,nomad] Log provider namespace during startup (#12002 by shreealt)
• [docker] Allow discovering non-running Docker containers (#10645 by acouvreur)
• [ecs] AWS ECS IPv6 Support (#12179 by wizbit)
• [file,k8s/crd,service] Add least time load balancing strategy (#12167 by sdelicata)
• [healthcheck,tcp] Add TCP Healthcheck (#11238 by ddtmachado)
• [healthcheck] Add passive health checks (#11351 by Nelwhix)
• [k8s/crd] Add highest random weight in Kubernetes CRD (#12061 by lbenguigui)
• [k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.4.0 (#12140 by kevinpollet)
• [k8s/ingress] Allow publishing services with type ExternalName (#12065 by james-callahan)
• [k8s] Add Knative provider (#11448 by idurgakalyan)
• [middleware,authentication] Add warning when maxBodySize is not set (#12085 by kianelbo)
• [middleware,server] Multi-layer routing (#12130 by sdelicata)
• [plugins] Support syscall (#11939 by david-garcia-garcia)
• [server] Implement HTTP2 HPACK table size options (#12050 by GCHQDeveloper548)
• [service,udp] Avoid allocations in readLoop by using sync.Pool (#12029 by arturmelanchyk)
• [service] Add HighestRandomWeight load balancing algorithm (#9946 by mathieuHa)
• [webui] Add Traefik Hub demo in dashboard (#12193 by gndz07)
• [webui] Reduce vertical padding in dashboard table rows for more compact layout (#12145 by leccelecce)

Documentation:

• Fix broken link to migration guide on readme (#12021 by 0slb)

Misc:

• Merge branch v3.5 into master (#12210 by rtribotte)
• Merge branch v3.5 into master (#12191 by rtribotte)
• Merge branch v3.5 into master (#12188 by rtribotte)
• Merge branch v3.5 into master (#12160 by rtribotte)
• Merge branch v3.5 into master (#12136 by kevinpollet)
• Merge branch v3.5 into master (#12120 by rtribotte)
• Merge branch v3.5 into master (#12095 by kevinpollet)
• Merge branch v3.5 into master (#12051 by rtribotte)
• Merge branch v3.5 into master (#11976 by kevinpollet)
• Merge branch v3.5 into master (#11940 by kevinpollet)
• Merge branch v3.5 into master (#11900 by kevinpollet)