1.21.0

Added

• Run the container as any non-root user, with every capability dropped.

• Add LISTEN_PORT to set the port nginx listens on inside the container.

• Support a read-only root filesystem with a tmpfs on /run/stackyard.

• Show free space per drive in the Disk Health tooltip with Scrutiny 1.78.0 or
  later.

Changed

• Reject a TRUSTED_PROXY entry that is not an IP address or network.

• The example Compose file stores config and icons in the data and icons
  volumes. Existing installs keep their ./data and ./icons lines.

• The health check fails while the API cannot write /data or /icons.

• Run on Node.js 26.

• Notices for actions that succeeded with a caveat use an amber warning colour
  instead of red.

• Sign out all devices, and an import that deletes items, focus Cancel first.
  Deleting an item no longer uses a red button.

Removed

• Stop attaching a not-affected statement for CVE-2026-107891 to Docker Hub
  images.

Fixed

• Admin form errors now appear under the field they refer to, which is marked
  invalid and focused.

• A wrong current password keeps the password dialog open with the error under
  the field.

• When the session runs out during a save in a dialog, sign-in opens on top and
  the save finishes afterwards.

• On phones, notices no longer cover the tab bar, and every notice has a Close
  button.

Security

• Run the container as the unprivileged node account by default.
  With host networking or a Linux kernel older than 4.11, set LISTEN_PORT to
  1024 or higher.

• Write the config file and its backups readable by their owner only.