Update traefik Docker tag to v3.6.11

[rednaw]

This PR contains the following updates:

Package	Update	Change
traefik	patch	v3.6.10 → v3.6.11

---

Release Notes

containous/traefik (traefik)

v3.6.11

Compare Source

CVE fixed:

• CVE-2026-32595 (Advisory GHSA-g3hg-j4jv-cwfr)
• CVE-2026-32305 (Advisory GHSA-wvvq-wgcr-9q48)
• CVE-2026-32695 (Advisory GHSA-67jx-r9pv-98rj)

Bug fixes:

• [logs, otel] Add OTel-conformant trace context attributes to access logs (#​12801 @​mmatur)
• [k8s/gatewayapi] Fix incorrect hostname matching between listener and route (#​12599 @​TheColorman)
• [k8s/ingress] Fix ingress router's rule (#​12808 @​gndz07)
• [webui] Remove AGPL license in code (#​12799 @​Desel72)
• [k8s/ingress-nginx] Fix proxy-ssl-verify annotation (#​12825 @​LBF38)
• [http] Add maxResponseBodySize configuration on HTTP provider (#​12788 @​gndz07)
• [tls] Support fragmented TLS client hello (#​12787 @​rtribotte)
• [middleware, authentication] Make basic auth check timing constant (#​12803 @​rtribotte)

Documentation:

• [k8s] Improve the multi tenant security note (#​12822 @​nmengin)
• Fix unnecessary escaping of pipe in regexp examples (#​12784 @​diegmonti)
• Add vulnerability submission quality guidelines (#​12807 @​emilevauge)
• Fix start up message format (#​12806 @​mloiseleur)
• Remove unsupported servers[n].address from TCP label examples (#​12817 @​sheddy-traefik)
• Bump mkdocs-traefiklabs to use consent mode (#​12804 @​darkweaver87)

v3.6.11

Compare Source

CVE fixed:

• CVE-2026-32595 (Advisory GHSA-g3hg-j4jv-cwfr)
• CVE-2026-32305 (Advisory GHSA-wvvq-wgcr-9q48)
• CVE-2026-32695 (Advisory GHSA-67jx-r9pv-98rj)

Bug fixes:

• [logs, otel] Add OTel-conformant trace context attributes to access logs (#​12801 @​mmatur)
• [k8s/gatewayapi] Fix incorrect hostname matching between listener and route (#​12599 @​TheColorman)
• [k8s/ingress] Fix ingress router's rule (#​12808 @​gndz07)
• [webui] Remove AGPL license in code (#​12799 @​Desel72)
• [k8s/ingress-nginx] Fix proxy-ssl-verify annotation (#​12825 @​LBF38)
• [http] Add maxResponseBodySize configuration on HTTP provider (#​12788 @​gndz07)
• [tls] Support fragmented TLS client hello (#​12787 @​rtribotte)
• [middleware, authentication] Make basic auth check timing constant (#​12803 @​rtribotte)

Documentation:

• [k8s] Improve the multi tenant security note (#​12822 @​nmengin)
• Fix unnecessary escaping of pipe in regexp examples (#​12784 @​diegmonti)
• Add vulnerability submission quality guidelines (#​12807 @​emilevauge)
• Fix start up message format (#​12806 @​mloiseleur)
• Remove unsupported servers[n].address from TCP label examples (#​12817 @​sheddy-traefik)
• Bump mkdocs-traefiklabs to use consent mode (#​12804 @​darkweaver87)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.