fix(deps): update module github.com/coredns/coredns to v1.14.4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/coredns/coredns	v1.14.3 → v1.14.4

---

Release Notes

coredns/coredns (github.com/coredns/coredns)

v1.14.4

Compare Source

This release improves transport security and operational flexibility, with
enhancements for DoH3 and DoQ, improved DNSSEC signing behavior, and support for
the loong64 architecture. It also adds configurable cache verification, hostname
resolution for forward targets, incoming connection support for dnstap, fallthrough
support in the secondary plugin, automatic zone reloads, and improved forwarding
behavior for NODATA responses.

Brought to You By

Cedric Wang
Charlie Tonneslan
Dmytro Alieksieiev
Endre Szabo
Immanuel Tikhonov
Isolus
James R T
JUN YANG
Jöran Malek
Nicholas Amorim
Syed Azeez
Umut Polat
Ville Vesilehto
weiguozhang
Yong Tang
徐晓伟

Noteworthy Changes

• core: Add loong64 arch support (#​8137)
• core: Bound HTTP/3 request header size for DoH3 (#​8135)
• core: Expose TLS ConnectionState (SNI) for DoQ (#​8129)
• core: Remove duplicate cipher suites (#​8118)
• core: Use http.LocalAddrContextKey for DoH local address (#​8149)
• plgin/kubernetes: Remove debug fmt.Println from multicluster zone validation (#​8131)
• plugin/any: Reject invalid any and local config (#​8133)
• plugin/azure: Apply access mode to every zone in the same block (#​8110)
• plugin/cache: Add optional verify timeout to serve_stale (#​8070)
• plugin/cache: Allow cache TTLs above default 3600s (#​8134)
• plugin/cache: Prefer positive cache over SERVFAIL in ncache (#​8003)
• plugin/chaos: Reject unknown chaos block options (#​8121)
• plugin/dnssec: Sign each RRset with the zone that owns its name, not the query zone (#​8138)
• plugin/dnstap: Feature: Added incoming connection support (#​8086)
• plugin/file: Canonicalize escape form in owner names (#​8109)
• plugin/file: Trigger reload of zones based on mtime (#​8085)
• plugin/forward: Add hostname resolution support for TO endpoints (#​5646) (#​7923)
• plugin/forward: Forward NODATA responses to Next handler (#​8065)
• plugin/health: Use descriptive error for unknown block options in health and log plugins (#​8128)
• plugin/ready: Reject unknown ready plugin properties (#​8119)
• plugin/proxyproto: Prevent nil pointer dereference when dropping malformed PROXY packets (#​8154)
• plugin/secondary: Add fallthrough support (#​8041)
• plugin/trace: Reject unknown trace and dnstap block options (#​8120)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 11 additional dependencies were updated

Details:

Package	Change
github.com/apparentlymart/go-cidr	v1.1.0 -> v1.1.1
github.com/pires/go-proxyproto	v0.11.0 -> v0.12.0
github.com/quic-go/quic-go	v0.59.0 -> v0.59.1
golang.org/x/crypto	v0.49.0 -> v0.52.0
golang.org/x/mod	v0.33.0 -> v0.35.0
golang.org/x/net	v0.52.0 -> v0.55.0
golang.org/x/sys	v0.43.0 -> v0.45.0
golang.org/x/text	v0.35.0 -> v0.37.0
golang.org/x/tools	v0.42.0 -> v0.44.0
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260401024825-9d38bb4040a9 -> v0.0.0-20260511170946-3700d4141b60
google.golang.org/grpc	v1.80.0 -> v1.81.1