v1.13.3

Features

• The Forward Auth wizards set a response size limit. Traefik 3.7 warns on every forward auth middleware without maxResponseBodySize, so the Authentik, Authelia, Gatekeeper and generic wizards now fill it with 4096 (#164)

Already seeing maxResponseBodySize is not configured in your Traefik log? That is an existing middleware. Its card now shows a warning icon - click it, review the line that gets added, and save.

Fixes

• A weighted, mirroring or failover service could name itself as a backend. Traefik expands that forever on load and exhausts memory, which took down a reporter's whole host. A service that references itself, directly or through other services, is now refused before anything is written (#167)
• Renaming a middleware left every route using it pointing at a name that no longer exists, so Traefik logged middleware "xxx@file" does not exist. A rename now moves the routes with it (#163)
• Deleting a middleware a route still uses is refused, naming the routes. Confirm and Traefik Manager removes it from them and deletes it
• Deleting a service a route still uses is refused, naming the routes and the services that list it. Confirm and Traefik Manager deletes those routes, removes it from the parents, and deletes any parent left empty. Until now the only way to remove a bad service was to repoint every route by hand first
• Renaming a service broke the routes using it the same way. It now moves them, and any parent weighted, mirroring or failover service that lists it
• Deleting a TLS profile a route still uses is refused, and profiles can now be renamed, which moves the routes using them
• Renaming a plugin left the middlewares using it pointing at the old name. A rename now moves them, and removing a plugin a middleware still uses is refused
• A failed sign in said nothing. The login page discarded every error it was given, so an OIDC failure looked like the page reloading for no reason. It now shows why
• Two OIDC callback failures logged nothing at all, which left no way to tell a rejected state from a provider error. Both now log what the provider sent back
• Turning off stat cards also hid the entry points bar. The bar was nested inside the stat cards block; the two toggles are independent now (#165)
• A working route showed a grey dot on the dashboard. The healthy case never set a colour. Where the service has a Traefik health check the dot follows it: green, amber for a degraded backend, red for down. Where it does not, Traefik Manager now checks the route itself and colours the dot from that, so an offline app reads red instead of grey (#165)
• A route was reported online whenever Traefik answered. A 502, 503 or 504 counted as up, so a dead app behind a live proxy looked healthy. Those now mean down, and the backend address is tried before giving up rather than only when the public URL cannot be reached (#165)
• References are followed across every config file, so a middleware defined in one file and used by a route in another stays connected