chr0nzz/traefik-manager v1.14.2 on GitHub

v1.14.2

Enhancements:

[webui, i18n] Invite you once to help translate the interface, in a popup that names your browser's language, links Weblate and the translator docs, and can be put off for two weeks or turned off for good (#184)
[docs] Add a Translations section to the README with the live per-language progress and where to help (#184)

Bug fixes:

[webui, routes] Keep the route Raw YAML editor on the theme the rest of the page uses, instead of staying dark after a switch to light (#185)
[routes] Show the serversTransports, middlewares and TLS options a route references in its Raw YAML, and write them back when you save, instead of leaving them out and silently discarding any you added (#185)
[routes, webui] Show the host Traefik resolved on the Routes tab, the route map, the domain filter and certificate matching, so a rule that builds its host with a Go template reads and links like any other route (#181)
[auth, oidc, security] Verify the provider's id_token before trusting it: check the signature against the provider's JWKS, the issuer, the audience against the client ID, and the expiry, instead of decoding the payload and reading the email and group claims that decide access (GHSA-4gj3-wgxw-79jj)
[auth, oidc, security] Refuse an OIDC sign-in where the provider returned no id_token at all, instead of skipping every check above and continuing on the unsigned userinfo response (GHSA-4gj3-wgxw-79jj)
[auth, oidc, security] Use an OIDC callback once, by taking the state out of the session when it is checked, and refuse a sign-in whose nonce is missing rather than skipping the comparison, so a callback cannot be replayed
[auth, oidc, security] Ignore a userinfo response whose sub names a different account than the verified id_token, instead of letting it overwrite the verified claims that decide access
[auth, oidc, security] Require the provider to say email_verified is true before an allowlisted email is accepted. An absent claim, a null, a 0 or an empty string used to pass as verified. If your provider does not send the claim, map it, or allow the account by group instead - the log names the missing claim
[setup, auth, security] Stop treating a manager.yml that cannot be read or parsed as a brand new install. A YAML error, a file that parses to a list or a bare scalar, or any read failure reopened the first-run setup wizard to an unauthenticated visitor, who could set the admin password and get a signed-in session. Setup now refuses to run until the file is fixed or restored
[auth, security] Write manager.yml, agents.yml and the secret encryption key so only the account running Traefik Manager can read them, keep a stricter mode you set yourself, and narrow an existing file once at startup. They were created world-readable, and every save undid a manual chmod
[notifications, security] Keep a notification channel's own bot token and webhook URL out of the delivery log. A provider's error usually quotes the request it could not make, so the credential was written to the log on every failed delivery
[auth, security] Remove control characters from the next parameter before checking it, so next=/<tab>/example.com can no longer redirect off the site
[auth, security] Check that an X-Api-Key header holds a real key before letting it skip the forced password change. Any value at all used to be enough
[auth] Say when two-factor is switched on but its secret cannot be decrypted, in Settings and in GET /api/auth/otp/status, instead of reporting a second factor that is never asked for. This happens when the encryption key is lost or replaced, which is now also written to the log
[build, security] Verify every third-party asset the build downloads against a recorded SHA-256, and fail on an HTTP error instead of saving the error page as the asset. The tailwindcss binary the build runs was fetched the same unchecked way
[build, security] Commit the docs lockfile and stop npm install from running dependency lifecycle scripts, closing the path a malicious postinstall used in May 2026
[ci, security] Pin every GitHub Action to a commit rather than a movable tag in the jobs that publish images and sign attestations, and stop leaving the workflow token in .git/config for later steps to read
[agent, release, security] Sign the agent binaries during the release, so gh attestation verify can tell a released binary from one added to the release afterwards
[webui, providers] Show a provider tab's route count as soon as the dashboard loads, for every provider, instead of leaving Internal, Consul, Nomad and the rest blank until the tab is opened
[agent, routes] Read an agent's router list without treating its completeness flags as routers, which broke the agent routes API and left agent routes unable to load (#181)
[routes, dashboard] Launch and check a route whose rule builds its host with a Go template, such as Host(`plex.{{ env `DOMAINNAME0` }}`), by taking the host Traefik resolved from its API instead of the raw template, so the route gets a link, a status dot and a search match like any other, while the config file keeps the template (#181)
[dashboard] Say a route's host comes from a template Traefik has not resolved, instead of "the rule has no host", when Traefik reports no router for it (#181)

Documentation:

[dashboard] Describe how a route with a templated host rule is launched and checked (#181)
[agent] Check the checksum, and the new build attestation, when installing an agent binary by hand