Traefik 3.6 ends August 16 —
the first Traefik minor that didn’t die overnight.

Traefik 3.6 reaches end of security support on August 16, 2026 — the day this piece was published. Its active support already ended on May 7; what stops now is the last thing still flowing: security fixes.

The date itself is routine. What is not routine is that 3.6 got a date at all. Every previous Traefik 3.x minor died the day its successor shipped — no security tail, no overlap, no grace. The average lifespan of a 3.x minor under that regime was 93 days. Traefik changed its policy with 3.6, and today is the first time the new rules actually retire a release.

What stops on August 16

Traefik 3.6 shipped on November 7, 2025. Active support — features and bug fixes — ended on May 7, 2026, and the release has run on security backports since. The most recent is 3.6.25. After August 16 there are no further releases of any kind for the 3.6 line.

Context matters for what this software is: Traefik is an ingress controller and reverse proxy, sitting at the network edge of a very large number of Kubernetes clusters and Docker hosts — the component that terminates TLS and touches every inbound request before your applications do. An unpatched ingress controller is not a dependency problem buried in a lockfile; it is the front door.

The 93-day treadmill nobody noticed

Here is the part of Traefik’s lifecycle most teams have never looked at. Until this year, Traefik’s own policy was that only the latest minor was supported at any moment — the instant a new minor shipped, the previous one stopped receiving anything, including security fixes. Measured across the six 3.x minors retired under that rule:

Seventy days. Seventy-seven. Seventy-nine. The v2 line ran the same treadmill — 2.7 lasted 36 days. If your patching cadence for edge infrastructure is quarterly, it was mathematically impossible to stay on a supported Traefik under the old policy without upgrading nearly every cycle. Most teams never noticed, because nothing announces that an ingress controller has silently left support — which is precisely the blind spot this site exists to close.

The policy that changed with 3.6 — and what it means for v2

Traefik’s release documentation now states: “Every minor is supported for 6 months from its GA release date, which means several minor versions can be supported at the same time” — and, explicitly: “These rules apply starting with Traefik v3.6. Before that, only the latest minor was on active support at any given time, and support for a minor ended as soon as the next one was released.”

So 3.6 is the first Traefik minor in history with a separate security window — roughly three months of fixes after 3.7 took over active support. That is a real improvement, and it is also a shorter runway than it sounds: six months per minor is still one of the fastest support cadences of any widely deployed infrastructure component. For comparison, the same class of software elsewhere measures support in years.

The policy has a second clause with a bigger blast radius: “The last minor after releasing a new major is supported for 2 years following the major release.” That clause is what governed Traefik v2 — and its clock has already run out. Traefik 2.11, the final v2 release, reached end of life on February 1, 2026, two years after 3.0 shipped. The v2 install base is enormous and migration to v3 involves real configuration changes, which is exactly the combination that leaves fleets parked on a dead major. If you are on any 2.x today, you have been unpatched for over six months — 40 is 2.11’s current risk score, and it only rises from here.

What to do

If you are on 3.6: move to 3.7. It is the only Traefik release line receiving security fixes after August 16, and within the 3.x line the upgrade is routine. Traefik has not published an end date for 3.7; under the 6-month policy, expect the next minor around November 2026 — and budget for that cadence permanently.

If you are on 3.0–3.5: you have been out of support since the day the next minor shipped — for 3.5 that was November 7, 2025. Same move, more urgency: 3.7, now.

If you are on v2: the migration to v3 is a project, not a patch — static configuration, rule syntax and middleware names all changed — but the alternative is an internet-facing proxy that stopped receiving security fixes in February. Start with Traefik’s v2-to-v3 migration guide, and treat the six months already elapsed as the schedule pressure it is.

If you cannot move now: the standard compensations apply with edge-component force: restrict who can reach the dashboard and API, pin provider permissions to least privilege, and record the decision with a date. An end-of-life ingress controller is the first thing a scanner finds and the last thing anyone remembers deploying.

Every Traefik release line, its dates and its EOL Risk Score are on the Traefik lifecycle page, updated at every build from upstream data.

Frequently Asked Questions