Caddy 2.11.7 fixes reverse-proxy crashes and one-minute SSE disconnects

Caddy 2.11.7, released October 3, 2026, fixes three related regressions from the default idle read/write deadlines introduced in 2.11.6. Under HTTP/2, a reverse proxy still reading a request body after its handler returned could trigger a nil-pointer panic. Under HTTP/1.1, POST-based SSE responses could terminate exactly 60 seconds after the request body was read. Separately, HTTP/2 SSE streams with more than a minute between writes could be reset because the idle writer incorrectly treated silence between writes as a stalled write. The patch also supports the IETF's RFC 10036 Incremental header, allowing an upstream to request immediate forwarding with `Incremental: ?1`. Configured buffering incompatible with this request now produces an explicit HTTP 501 instead of silently buffering.

SSE and long-lived HTTP responses support live dashboards, coding-agent progress and AI token streaming. A proxy patch that breaks these flows only after a minute of quiet traffic is easily misdiagnosed as an application or network problem. For Caddy 2.11.6 operators, upgrading is a concrete reliability fix. RFC 10036 introduces a standards-based alternative to proxy-specific buffering controls, but unsupported intermediaries may still buffer. The release documents a crash but does not establish security exploitability or incident prevalence.

Caddy 2.11.6 introduced default one-minute idle read/write timeouts. A request-body deadline could survive beyond its owning handler, producing an HTTP/2 nil-pointer panic or severing HTTP/1.1 POST-based SSE. A separate HTTP/2 issue counted gaps between writes as idle writer time and reset otherwise healthy streams. Upstream PRs #8107 and #8119 repair these failures.

An independent Docker comparison tested SSE responses with 70 seconds of upstream silence using GET and POST over HTTP/1.1 and HTTP/2. The tester reported three of four variants were interrupted at approximately 60 seconds on Caddy 2.11.6, while 2.11.4 and 2.11.7 allowed all four to finish. This is a narrow reproducibility check, not a general reliability benchmark.

The IETF published RFC 10036 as a Standards Track document in August 2026. Caddy 2.11.7 uses `Incremental: ?1` to forward streamed upstream responses promptly through reverse_proxy and encode. If configured request_buffers or response_buffers prevent this, it returns 501 with Proxy-Status information. The standard explicitly warns that proxies lacking support can still buffer.

The release restores empty output for absent cookie and TLS placeholders, preserves separate Set-Cookie headers, cleans up old Unix sockets after reload, and reduces TLS handshake work under particular conditions. It does not revert all 2.11.6 changes, including stricter default limits.