Hi all, Starting work on caddy for bookworm - it's on dla-needed.txt (added by Front-Desk back in July) and still unclaimed as far as I can tell, so flagging here per the LTS wiki's guidance for casual contributors rather than editing dla-needed.txt myself.
Bookworm ships 2.6.2-5, vulnerable to 8 CVEs already fixed upstream by 2.11.4 (CVE-2026-52846, -52845, -45692, -27590, -27589, -27588, -27587, -27585). I've backported and test-verified four of the more contained ones so far (27585, 27587, 27588, 52846 - matcher and template fixes, no new dependencies). The remaining four are more involved: two touch admin.go alongside unrelated upstream refactoring that needs untangling, and one (27590) pulls in a new dependency (golang.org/x/text/search) I still need to check against what's already packaged for bookworm. Will follow up with patches once I've got the rest sorted. Let me know if someone's already on this or if I should approach it differently. Ivo
