- Fixed light theme to correctly apply the blue topbar and ensure text colors are consistent with the selected theme.
- Updated theme management to persist the selected theme and its corresponding palette across sessions.
- Enhanced documentation to clarify theme color mappings and behavior.
- Introduced built-in theme palettes for light and dark modes to streamline theme application.
- Improved CSS variable handling for better theme integration in the UI.
This update addresses user feedback regarding theme inconsistencies and improves overall theme functionality.
- Added UX 3.5 as the default console shell, featuring a full-list sidebar, topbar, and customizable themes (Dark/Light/Custom).
- Updated documentation to reflect the new UX 3.5 shell.
- Removed legacy Desktop Mode and Beta 3.1 styles, ensuring a streamlined user experience.
- Enhanced language support for new theme options across multiple languages.
- Fixed OIDC client login issues by proxying callback URLs to the Go API.
This update improves the overall user interface and experience, aligning with modern design standards.
Panel Redirect URLs on :5000/:5443 used to 404, so auth-query never completed. Proxy the callback to Go, validate the path in Settings, and document the fix.
Guest /ws upgrades must pass Go access-link validation; RustDesk OIDC auth-query rejects omitted id/uuid when pending has them; bump tar and golang.org/x/text for audit/govulncheck.
Populate CHANGELOG [Unreleased] with curated operator highlights since main 3.3.39, and remove illegal const password reassignment in ensureDefaultAdmin.
Skip mirrorCreate on shared Postgres, block 409→create recursion, COALESCE totp_secret on Go ListUsers, and return username_exists on DB unique violations.
Never-logged-in Go SQLite users no longer break ListUsers/delete/demote (500), so panel userSync can mirror instead of restoring phantom accounts on restart.
Require TRUSTED_PROXIES before honoring X-Forwarded headers, and deliver async PunchHole/RelayResponse via ip:port wsPunchConns so shared-NAT peers do not get the wrong signed PK.
Store PUBLIC_* on the console-data volume so panel settings survive compose recreate; keep Compose env override and .env mirror for IaC and bare-metal.
Copy panel password hashes into missing Go users on SQLite dual-DB so RustDesk client login matches the console; clarify LDAP sub-tab discoverability and provider-bound hints.
Temporary opaque links give guests a minimal Web Remote UI for selected devices only, without Console inventory or add-any-ID paths. Also fix mesh_share desktop tunnel auth for unauthenticated guests.
UNITRONIX