v1.10.0

Features

• New design - switch under Settings -> Interface -> Layout. Modern replaces the tab row with a collapsible side navigation.

• Redesigned stat panel - the four donuts are gone. Each card now shows the total as a readable number, a signal strip with one cell per object (worst first, hover for the name and reason), and clickable exception counts that jump straight to the filtered list. A verdict line above the grid sums up every problem and names the providers that own them, and a provider strip scopes all four cards to one provider in a click. Entry points become aligned rows with protocol, flags, address, a per-entry-point router strip and a runtime footer. Compact mode is the same DOM, not a second hidden copy.

• Redesigned Logs tab - the access log becomes analytics you can click through. Seven cards (status codes, response time, methods, domains, paths, clients, services) each with a total, a per-request signal strip and clickable counts that filter the log list. A "where it fails" panel names the worst status-and-path pairs with their share of that path's own traffic. Every count is a filter, a Clear button resets them all, and the panel states plainly that it describes the last N lines and not all traffic. Domains need a JSON access log; on common format the card says so and links to the setting.

• Redesigned CrowdSec tab - rebuilt around the attack rather than the ban list. Alerts are now the primary view with decisions one click behind. Six cards: attacking sources, networks by ASN, scenarios, targeted paths (or accounts on an SSH host), tooling by user agent, and bans in force. Colour marks only what is not handled, so a host being probed but absorbed cleanly reads calm. No caps: every decision and alert is fetched, on the host and on agents. A Clear button resets every filter, and any unbanned source can be banned straight from its row.

• Static Config is now a tab - it moved out of the Settings modal into its own optional tab, off by default, under Settings -> Interface. And the tab is hidden when traefik.yml is not mounted.

• Dashboard icon grid - Settings -> Interface -> Dashboard categories switches each category to a grid of app icons instead of rows.

Fixes

• Agent: saving static config failed when traefik.yml is a single-file bind mount
• Agent: restart via socket proxy failed on tcp:// DOCKER_HOST, and sent SIGHUP instead of an actual container restart
• Plugins tab showed the Host's setup instructions when an agent was active
• Editing a plugin from the Plugins tab wiped its module name and version
• Editing a disabled route saved it as enabled and could leave a duplicate behind. Edits to a disabled route now stay disabled
• Dashboard custom groups, display names, icons and link overrides were shared between the Host and every agent. They are now kept per server
• Stored XSS in the dashboard groups list: a custom group name could break out of its input attribute
• The dashboard reported "no routes" as fact when Traefik was unreachable, because the API turned a failed call into an empty list
• Two routers with the same name from different providers shared one status on the dashboard
• Entry points other than websecure were wrongly flagged as insecure by a comparison that always evaluated false
• Plugin install claimed the middleware was saved even when there was nowhere to write it
• Plugin install now asks which config file the middleware goes to (existing or new, host and agents)
• ACME_JSON_PATH pointing at a top-level directory like /letsencrypt was blocked by the path safety check, so its certificates never listed. Deeper mounts also no longer whitelist their parent directory (#121)
• CrowdSec decisions past the first 5000 could not be searched or unbanned (#130)
• CrowdSec alert timestamps showed empty
• Docker expose-by-default toggle was inert and misreported
• Stat cards counted only file-provider objects, so Docker and Kubernetes routers were missing from every total
• Routers and services past Traefik's first page of 1000 were silently dropped, on the host and on agents
• Services with a DOWN backend now classify as a warning on the Services tab, so the card's backends down link lands on them
• app.css is cache busted with the app version, so an upgrade never renders new markup against a cached stylesheet
• Stored XSS in the Logs tab: an attacker-controlled request path could break out of the row's click handler
• TLS profiles from the Host were listed on every agent's TLS Options tab, and saving or deleting one while an agent was selected wrote to the Host's config. Profiles are now read and written per server
• The route delete dialog named the internal route id, so a multi-file install saw dynamic.yml::app instead of the route name
• CrowdSec reported "0 decisions" as fact when the LAPI was unreachable; it now says it could not reach it
• CrowdSec was treated as unconfigured when only machine credentials were set. The bouncer key and the machine login are complementary, not tiered
• Decisions added from the UI were stamped with an origin CrowdSec does not have, so they were hard to find afterwards
• Switching from an agent back to the Host could raise a false self-route entrypoint warning, because a stale agent data load finished after the switch. Its Fix button would have rewritten a working self-route
• Compound durations in the access log parsed wrong, so 2m30s read as 2000ms
• The Services card on a common format log was really ranking routers, and now says so
• Exception counts rendered in body-text colour instead of yellow or red, on the dashboard and the Logs tab