v1.10.2

Fixes

• Routes and Middleware kept the previous server's data after switching host or agent
• Saving a route rewrote the config file in place, so Traefik's file watcher could read it half-written and reject a router with a spurious parse error. Writes are now atomic
• Password reset no longer re-runs the setup wizard
• The Show button in Dashboard settings did nothing, so hidden apps could not be brought back
• Opening a modal while another was open left both open, so the first kept your input out of sight
• Disabled routes showed their status as unknown and blamed the Traefik API, rather than saying they were disabled
• The sign-in page ignored the configured default theme in any browser that had used the theme toggle
• Saving the static config failed with "path is outside allowed directories" on native installs, where traefik.yml sits outside the dynamic config directory (#143)
• access_log_path, acme_json_path and static_config_path set in manager.yml were ignored unless the matching env var was also set (#144)
• OIDC sign-in failed with a bare 400 against Authentik and Authelia. (#141)
• OIDC now sends a PKCE challenge, required by public clients
• OIDC token exchange errors showed only 400 Bad Request. The provider's reason is now logged and shown
• OIDC client authentication now follows RFC 6749: credentials are form-encoded before the Basic header, so a secret containing % or + no longer arrives corrupted at providers that decode it, Authentik among them
• OIDC public clients (no client secret) now send no client authentication at all, instead of an empty Basic header the provider rejects
• OIDC now tries the other client authentication method when the provider answers invalid_client, so a client configured for POST-body credentials no longer fails against a provider advertising Basic. Only that error is retried, never invalid_grant
• OIDC sign-in could hang until the gunicorn worker was killed when the userinfo endpoint was unreachable. It is only called when the id_token is missing something, and its connect timeout is bounded
• The OIDC Test button implied the client ID and secret had been checked. It only reaches the provider, and now says so