This release includes 1 security fix for security teams reviewing exposed deployments.
Published 4d
Reverse Proxies & Load Balancers
✓ No known CVEs patched
This release patches 1 known CVE
Topics
alpine-linux
bcrypt
crsf
csrf-protection
docker
fernet
+13 more
flask
flask-limiter
flask-session
gunicorn
phosphor-icons
python
ruamel-yaml
tailwind-css
totp
traefik
traefik-management
traefik-web-ui
vanilla-js
Affected surfaces
auth
breaking_upgrade
Summary
AI summaryUpdates v1.7.3, non-Docker, and CLF across a mixed release.
Full changelog
v1.7.3
Fixes
- Native (non-Docker) agent install now works (fixes #106) - the installer downloaded the agent binary from the GitHub release, but those binaries were never published, so the native/systemd agent install failed with a 404. Releases now publish
tma-linux-amd64,tma-linux-arm64, andtma-linux-armv7binaries. The stack installer also no longer falls back to a possibly-missingdocker-composecommand (it uses the Compose v2/v1 it already validated). - Config-safety and correctness across routes, toggles, and OIDC (#111, thanks @fbnlrz) - deleting or disabling a route no longer removes a service a second router still uses; the route toggle honours the
configFile::prefix so a same-named router in another file isn't affected; Go template expressions survive disable/enable; the agent proxy forwards query strings (so remote log line-count selection works); OIDC login is denied when the provider reports the email as unverified (closing an email-allowlist bypass); malformed config (null sections, non-mapping services) no longer 500s the Routes tab; and a few transposed notification/log-validation fixes. - Service-type notice in the route modal (#108, thanks @fbnlrz) - routes backed by a
weighted,mirroring, orfailoverservice (which #102 correctly leaves untouched) now show a notice and lock the target field, instead of silently ignoring an edit. - Wrong wildcard cert domains on edit (#110, thanks @fbnlrz) - after editing a route with a wildcard certificate, opening and saving a different route could write the first route's
tls.domainsonto it. The stale wildcard fields are now cleared. - Active server restored across reloads (#107, thanks @fbnlrz) - the multi-server switcher now remembers the selected agent across page reloads instead of dropping back to the Host.
- Route saves no longer drop hand-written config (#102, thanks @fbnlrz) - editing a route in the modal used to rebuild the router and service from the form and discard anything the form doesn't manage. Saves now merge in place: router
priority/observability, sticky sessions, health checks, additional servers, your ownserversTransport, and surrounding comments are preserved, and an existing route keeps the service name it already points at instead of being renamed to<name>-service. Aweighted,mirroring, orfailoverservice is left untouched. The form still owns the rule, entry points, service reference, middlewares, TLS, and the first server address, so clearing those in the modal still removes them. - Bulk delete on remote servers (#102, thanks @fbnlrz) - bulk delete didn't send
agent_id, so with a remote server active it could delete a same-named route from the Host instead. It now targets the correct server and reports how many deletions failed. - Modals no longer wipe a filled-in form on a rejected save (#102, thanks @fbnlrz) - the route and middleware modals now close only on success. Clone Route also copies the rule, service name, and config file.
- Blank Routes tab (#103, thanks @fbnlrz) - the Routes tab (the default landing tab) rendered an empty grid on a fresh install because its empty-state element was missing. It now shows an Add Route prompt when there are no routes, and a "No routes match your filters" message when a search or filter hides everything.
- JSON access logs in the Logs tab (#104, thanks @fbnlrz) - the Logs tab only parsed the
common(CLF) format, soaccessLog.format: jsonfell back to a raw dump with no columns, stats, or geolocation. JSON access logs are now parsed into the same cards, which also means IP geolocation works for JSON-log setups. - Escape closes editing modals (#105, thanks @fbnlrz) - the route, middleware, settings, TLS-options, and dashboard modals now close on Escape (previously only the read-only panels did). The custom-domain chip input clears its in-progress value on the first Escape and closes the modal on the second.
Security Fixes
- OIDC login is denied when the provider reports the email as unverified, closing an email‑allowlist bypass.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]