Upgrade Caddy to 2.11.0-beta.2 across proxy components #21242
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
kylos101
approved these changes
Jan 9, 2026
Contributor
kylos101
left a comment
kylos101
left a comment
There was a problem hiding this comment.
Added a couple observations, no blocking questions or concerns, adding ✅ to unblock.
Comment on lines
-7
to
-11
| RUN go install golang.org/dl/go1.24.3@latest && \ | ||
| go1.24.3 download && \ | ||
| rm -rf /usr/local/go && \ | ||
| mv /go /usr/local/go && \ | ||
| mv /usr/local/go/bin/go1.24.3 /usr/local/go/bin/go |
Contributor
There was a problem hiding this comment.
Nice, i see caddy 2.10 has go built-in now as the base image
components/proxy/Dockerfile
Outdated
| --with github.com/gitpod-io/gitpod/proxy/plugins/frontend_dev=/plugins/frontend_dev | ||
|
|
||
| FROM cgr.dev/chainguard/wolfi-base:latest@sha256:815b27b8a70713c70404e44a718eddd52ea6f4a2bfad5f56455b52cd2789a9b2 | ||
| FROM caddy/caddy:2.10.2-alpine |
Contributor
There was a problem hiding this comment.
The only bummer here, is that we're switching from chainguard to caddy. But I get it, and see dashboard and ide-proxy already use.
Co-authored-by: Ona <no-reply@ona.com>
- Update Dockerfile to use caddy:2.10.2-builder and caddy/caddy:2.10.2-alpine - Update all 10 plugin go.mod files from Caddy v2.7.6 to v2.10.2 - Fix sshtunnel plugin: replace deprecated caddy.Listen() with NetworkAddress.Listen() - Remove intermediate Go version upgrade stage (caddy:2.10.2-builder includes Go 1.24+) Fixes several HIGH severity vulnerabilities: - GHSA-7jwh-3vrq-q3m8 (pgproto3 SQL injection) - GHSA-m7wr-2xf7-cm9p (pgx SQL injection) - GHSA-mrww-27vc-gghv (pgx SQL injection) - GHSA-c33x-xqrf-c478 (quic-go DoS) - GHSA-vrw8-fxc6-2r93 (chi host header injection) Co-authored-by: Ona <no-reply@ona.com>
geropl
force-pushed
the
gpl/clc-2189-proxy-caddy-upgrade
branch
from
0dd7f3c to
142b6c2
Compare
Member
Author
Test ProtocolTested on preview environment
All proxy functionality verified working after Caddy 2.10.2 upgrade. |
Co-authored-by: Ona <no-reply@ona.com>
Upgrade from Caddy 2.10.2 to 2.11.0-beta.2 to fix GHSA-h8cp-697h-8c8p (Critical - authorization bypass in smallstep/certificates ACME/SCEP). - proxy: Use caddy:builder with xcaddy build v2.11.0-beta.2 - ide-proxy, dashboard: Use caddy/caddy:2.11-alpine - Update all plugin go.mod files to Caddy v2.11.0-beta.2 Co-authored-by: Ona <no-reply@ona.com>
geropl
changed the title
Co-authored-by: Ona <no-reply@ona.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Upgrade Caddy to 2.11.0-beta.2 across all proxy-related components to fix a critical security vulnerability (GHSA-h8cp-697h-8c8p).
Changes
ide-proxy & dashboard (commit 1):
caddy/caddyimage from 2.9.1 to 2.11-alpineproxy component (commit 2):
caddy:builderwithxcaddy build v2.11.0-beta.2caddy/caddy:2.11-alpinecaddy.Listen()withNetworkAddress.Listen()APIAdditional upgrade to beta.2 (commit 3):
Vulnerabilities Fixed
CRITICAL severity:
HIGH severity:
MEDIUM severity:
Note on Beta Version
Using Caddy 2.11.0-beta.2 because:
Related Issue(s)
Fixes CLC-2189
How to test
Tested on preview environment
gpl-clc-21b31317cbc2.preview.gitpod-dev.com:All tests verified on 2026-01-12.