Release v3.20.0 · traefik/hub

Features

Traefik Hub v3.20 graduates several Early Access features to generally available, including OpenAPI request body schema validation, custom OAuth 2.1 client credentials scopes, the Nutanix Prism Central provider, customizable guard deny responses, native Responses API support, unified LLM Guard configuration, Parallel LLM Guard, the Content Guard Regex engine, advanced WAF security annotations for the Kubernetes Ingress NGINX provider, automatic failover between LLM providers, Token Rate Limit and Quota middleware, and customizable API key sources for APIAuth. Multi-cluster features remain Early Access.
Added Portal custom content through the ContentItem CRD, allowing Markdown pages, HTML pages, and navigation links to be attached to an APIPortal, API, or APIBundle.
Added onDenyResponse support to the Token Rate Limit middleware.
Migrated FIPS support to the Go native cryptographic module.

Update Traefik Proxy to v3.7.0, bringing Gateway API v1.5.1 support, Knative provider v1.20.0 integration, refreshed Traefik Proxy v3.7 CRD references, wildcard Host and HostSNI matchers, provider precedence configuration, service-level middlewares for Kubernetes CRD Services, new ForwardAuth and Retry options, ACME certificateTimeout, accesslog.dualOutput, and related routing, middleware, TLS, and observability updates.
Update Static Analyzer to v1.8.0.
Bump libopenapi-validator to v0.13.7 and remove the previous workaround.

Fixed OpenAPI base path handling when the base path fully consumes the request path.
Fixed MCP well-known entrypoint resolution through parent routers.
Fixed the allowParamsOverride default value in the Chat Completion middleware.
Added tracing to the Responses API middleware.
Fixed the OIDC middleware and exchange token single-flight handling.

This release comes with the following components: