Traefik 3.7.11

I upgraded a handful of Traefik deployments to 3.7.11 so you don't have to guess whether this one is worth it. Verdict first: it's a bugfix release with real substance behind it — the Kubernetes providers get a meaningful set of fixes that close some annoying edge cases, plus a dependency bump worth knowing about.

The Quick Upgrade Notes

This is a drop-in patch release — no config changes, no breaking changes. If you're on the 3.7 line, you can roll it out straight through your normal pipeline. If you're still on older versions, this is a fine place to land.

• FastProxy hardening — out-of-range status codes from backends are now rejected instead of being passed through to clients.
• quic-go bump — HTTP/3 support moves to github.com/quic-go/quic-go v0.61.0 for stability and security fixes.
• Kubernetes CRD naming — a whole batch of fixes around generated name collisions across the CRD provider, including safe-naming options and namespace-restricted default TLS resources.

The Kubernetes Fixes

The bulk of this release is in the Kubernetes providers, and it's a genuinely useful cleanup. The CRD provider now scopes generated Service names to their parent, names failover services after the referenced Service, and adds a safe-naming option to avoid collisions. For the Gateway API provider, encoded path segments in URLRewrite and RequestRedirect are now preserved correctly, and router rule handling got fixed.

There's also a deduplication fix for the ingress-nginx provider — client-auth TLS options across ingresses sharing a host no longer get applied twice.

Was It Worth It?

If you run Traefik against Kubernetes at any scale, yes — update now. The naming-collision fixes alone are worth it for anyone managing many ingresses or CRDs. If you're a simple static or Docker-only setup, the FastProxy status-code fix still justifies the pull, but the K8s work is where the real value sits in 3.7.11.