- Added multi‑issuer TLS support with fallback (defaulting to Let’s Encrypt and ZeroSSL) and alternate certificate chain selection; improved on‑demand TLS handling for large‑scale deployments
- Introduced production‑ready map handler and Caddyfile extensions to configure servers, listeners, and global options (e.g., http3) directly in the Caddyfile
- Minor breaking changes: remote_ip matcher no longer reads X‑Forwarded‑For by default and experimental http3 option moved; deprecated "issuer" field in automation policies; documentation reorganized