*.example.com). Wildcards follow TLS (RFC 6125) semantics and match
exactly one label. An exact domain always wins over a wildcard. Also fixed a
bug where duplicated namespaces could be created in the root VCL.vcli vg rolling-upgrade pause|resume|next).vcli inv new --name ...), shown when listing invalidations.vcli license varnish add/list). Agents validate the license and load it
into Varnish at runtime.secure-create-fs-perms flag
(agent, brainz and router), files are created as 0640 and directories as
0770 with setgid instead of 0644/0755. This is the default for new
installations. Components existing before the upgrade keep the legacy
permissions through a per-component configuration override (see the
upgrade notes).VARNISH_CONTROLLER_ environment variables, [ui-server] configuration file
section). It gains
SSO login
through the organization’s IDP (/sso), TLS certificates managed and pushed
by the controller on the new -https-port (including
ACME certificates, whose http-01
challenges it answers itself), and configuration broadcast from brainz over
NATS that a system administrator can change on a running fleet
(vcli configs update -f type=ui-server ...).Origin and
Sec-Fetch-Site headers plus the new -trusted-origins instead of a CSRF
token. Several configuration flags have been renamed, removed or changed
meaning, see the
upgrade notes.vcli now identifies the server it talks to and refuses to use a UI server
endpoint (the UI server proxies the API but strips the session tokens), and
validates that its version is compatible with the API-GW.vcli router health).score, latitude and longitude for each endpoint.= characters in configuration file values.baseURLNoPort.vcli to fail properly when VCL compilation fails during deploy.GET-method requirement on the JSON health check response
(traffic_router_health.vcl),
and reload the root VCL when the generated health check VCL changes.WARN level for
better operational visibility.Score routing rule and sub-decisions. Allows MBPS, Max MBPS and Score updates through
the JSON instead of over NATS (see Score Routing example).stop-routing or resume-routing.vcli
(e.g. vcli vg compile --validate tag=prod,sweden:all).vcli vg ls now list first 10 include files before and the rest as “..(n more entries)”. Verbose (-v) mode shows all.keep so that they are kept and not automatically removed. They can then be re-executed at a later time. Kept invalidations
needs to be manually removed.skipHistoryUtil option to routing rules. When enabled, the router checks endpoint utilization before returning cached history endpoints, skipping fully utilized ones.APIPurger template role and basicinvalidationrequest permission, allowing organization-level users to trigger basic cache invalidation without requiring system administrator privileges.-git-tag flag for vcli to specify tag to use for deployment (can be used for deploy, compile and validate).VARNISH_CONTROLLER_DB_MAX_OPEN_CONN and VARNISH_CONTROLLER_DB_MAX_IDLE_CONN to 0.vcli agent ls -v now only lists 10 deployed VCLGroups per agent and indicates if there are more than 10 with a “..(n more entries)” suffix.customsession.[neq] API operator that can be used to filter records.
API Examples_info records.vcli vclgroup deploy-files <vg-id> --includes 2:latest.
CLI ExamplesForbidden - CSRF token not found in request error message./api/v1/internal-metrics.vcli stats prune ... command and via the API with a DELETE /api/v1/stats.vcli results, the new accept-empty flag allows empty results without giving an
error.acme-timeout
parameter.vcli acme lookup-dns ... and via the API with
a POST /api/v1/acme/dns-record.vcli can now read the password from the environment variable VARNISH_CONTROLLER_CLI_PASSWORD.0.0.0.0/0 and ::/0 in CIDR routing decision.vcli when creating a custom token/session now supports dates as well as duration.
vcli sess create --label MyLongLivedtoken -e '2025-08-05T15:04:05Z'
vcli sess create --label MyLongLivedtoken -e '2025-11-26 19:11:20'
vcli sess create --label MyLongLivedtoken -e 60h
root.vcl skipping toLower for domain matching (improves performance when many domains
are deployed). This is now done in the agent instead of the VCL.root.vcl is now using none case-sensitive domain matching.BaseURL had been configured in the agent.ipv4MinMask and ipv6MinMask) to set the minimum
mask for IPv4 and IPv6 addresses for router DNS responses.-keep-stats-* configurations.gitRepos endpoint now lowercased.x-nullable for string pointers.Deployments has been removed and replaced with TagSets directly on VCLGroups.git as a dependency when installing the brainz package.allSans option to load all SAN entries into Varnish, including
wildcards.