mescon/Muximux v3.6.2

on GitHub

Sidebar fixes and safer parsing: groups in the icon-only sidebar can be
expanded and collapsed again, the health tooltip no longer pops up when you
click an app, and a misspelt or empty boolean Docker label or environment
variable no longer changes anything behind your back.

Upgrade notes:

• A misspelt or empty boolean label (for example muximux.app.enabled=tru
  or muximux.gateway.require_auth=) is now ignored instead of reading as
  false; an existing app or site keeps its current value, and the Discover
  modal notes the label. Boolean labels accept true/1/yes/on and
  false/0/no/off.
• An empty MUXIMUX_* override variable (for example
  MUXIMUX_DISCOVERY_AUTO_IMPORT= from a Compose ${VAR} that is not
  defined) no longer forces a value; the config file value stays.

Fixed

• Boolean labels are strict. Every boolean muximux.app.* and
  muximux.gateway.* label takes true/1/yes/on or
  false/0/no/off (case-insensitive); any other value is ignored with
  a note in the Discover modal and one warning in the log. A misspelt or
  empty value keeps the current setting on update and sync, so
  require_auth=ture or require_auth= never makes a protected gateway site
  public; on first import the default applies.
• An empty environment override counts as unset. MUXIMUX_DISCOVERY_AUTO_IMPORT,
  MUXIMUX_DISCOVERY_REQUIRE_EXPLICIT_ENABLE, MUXIMUX_LISTEN,
  MUXIMUX_BASE_PATH, MUXIMUX_LOG_LEVEL, MUXIMUX_LOG_FORMAT,
  MUXIMUX_DATA and MUXIMUX_CONFIG now treat an empty or whitespace-only
  value as unset, as the auth and OIDC variables already did.
• Sidebar groups expand and collapse with Show Labels off. The group
  icon in the icon-only left and right sidebars is now a button with
  aria-expanded and the group name as its accessible name; it was inert,
  so apps in a collapsed group could not be reached. (#523)
• The health tooltip opens only from the indicator. Clicking an app no
  longer opens it (a mouse click focused the link and opened it, and it
  could stay until the next click). It now needs hover on the dot or
  keyboard focus, and closes on leave, click elsewhere, Escape, scroll or
  app switch. (#522)

Security

• Theme deletion is confined to the themes directory. Removing a custom
  theme now goes through os.Root, so the path cannot leave the themes
  directory even if the name check were loosened. A missing themes
  directory still answers "Theme not found"; any other failure to open it
  returns a server error instead.