This release adds 2 notable features for engineering teams evaluating rollout.
Published 2mo
Reverse Proxies & Load Balancers
✓ No known CVEs patched
✓ No known CVEs patched in this version
Topics
alpine-linux
bcrypt
crsf
csrf-protection
docker
fernet
+13 more
flask
flask-limiter
flask-session
gunicorn
phosphor-icons
python
ruamel-yaml
tailwind-css
totp
traefik
traefik-management
traefik-web-ui
vanilla-js
Affected surfaces
auth
Summary
AI summaryUpdates Bug Fixes, What's New, and https://github.com/chr0nzz/traefik-manager/issues/38 across a mixed release.
Full changelog
What's New
- Advanced rule editor for HTTP routes - a toggle in the Add/Edit Route form switches between the domain chip builder and a free-text rule input for complex rules like
Host(sub.domain.tld) || HostRegexp(^.*.sub.domain.tld)orPathPrefix(/api). When editing a route with a complex rule, the form automatically switches to advanced mode. (#34, #38) - Provider middlewares in provider tabs - Docker, Kubernetes, Swarm, and all other provider tabs now show middlewares from that provider in a read-only section below the routes list. (#36)
Bug Fixes
- "No TLS" now omits the tls block entirely - the cert resolver dropdown now has a distinct "No TLS" option that writes no
tlskey to the config. Previously selecting "None" would writetls: {}which Traefik interprets as TLS-enabled with default options. "None (external / custom cert)" is preserved for users managing certificates externally. (#41) - Routes and services capped at 100 - the Traefik API returns 100 results per page by default. TM now paginates through all pages so the full list of routers, services, and middlewares is returned regardless of count. (#42)
- Route card shows wrong label for advanced rules containing Host() - rules like
Host(app.example.com) && PathPrefix(/api)were incorrectly showing a "Domain" label instead of "Rule" because the card only checked for the absence of any Host() match. The card now correctly identifies any rule that isn't a pure Host()-only expression. (#38) - Route cards revert to wrong label on page reload - server-side rendered route cards used a Jinja2 template that stripped everything after
&&in compound rules, showing just the domain. TM now refreshes route cards via AJAX on page init so the correct label always shows. (#38) - Backup restore and delete broken for filenames with spaces - backup filenames were not URL-encoded before being used in fetch URLs, and the backend validation regex rejected filenames containing spaces. Both fixed - spaces are now allowed in config file names and correctly handled in the restore/delete URLs.
- Notifications not persisted across restarts - notifications were saved to disk in a daemon background thread which was killed when gunicorn restarted workers, causing any notification added since the last save to be lost. Now saved synchronously.
- Missing notifications for login, OTP, OIDC, and update available - OTP login, OIDC login, and update detection did not generate notifications in the panel. All three now produce notifications. Notification cap increased from 100 to 200.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]