1.5.1
1.5.1 - 2026-08-08
A fix release. One item matters more than the rest: on 1.5.0, saving anything failed if you reached Stackyard directly on a mapped port. If you run it as http://your-server:8700 rather than behind a reverse proxy, upgrade.
Fixed
- Saving settings, logging in, and every other write now work when Stackyard is reached directly on a mapped port, such as
http://server:8700. nginx forwarded a Host header with the port stripped while the browser's Origin kept it, so the two never matched and every write was refused as an origin mismatch. Only installs behind a reverse proxy on 443 were unaffected, which is how it survived 1.5.0. - German, Spanish, French, Persian and Chinese translate a further 34 strings that were left as English in their catalogues.
- Admin translates the Dock, Health and Badge pills, the Edit button, the Secret checkbox, the colour and poll-interval labels, the widget Name and Widget Type labels, and the editor's section title. All were English in every language.
- The poll interval reads as one sentence in every language instead of wrapping the field in English words.
- App and widget names in the Settings list sit beside their icon in Persian instead of aligning to the far side of the row.
- The divider between the Settings navigation and the section beside it runs the full length of the section instead of stopping one screen down.
- The icon preview in the app editor no longer draws its artwork edge to edge.
- Colour swatches that wrap onto a second row line up under the row above instead of splitting to opposite edges.
Also published to Docker Hub
From this release, images are mirrored:
ghcr.io/sandobserver/stackyard:1.5.1
docker.io/sandobserver/stackyard:1.5.1
ghcr.io remains the one to prefer, and the one the signature below covers.
Verifying this release
cosign verify ghcr.io/sandobserver/stackyard:1.5.1 \
--certificate-identity-regexp '^https://github.com/SandObserver/stackyard/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
The build also scans the image with Trivy, failing on a fixable HIGH or CRITICAL, and attaches an SPDX SBOM. See docs/security.md.
For maintainers
- A Playwright suite drives the admin UI against the built image, in Chromium and WebKit. It found the origin bug on its first working run.
- Those browser tests run on pull requests that touch the interface, on every merge, and as a gate on the release: a tag can no longer publish an image they reject.
- Backend coverage is measured against a floor, the frontend path map is checked, formatting is enforced, and the module-system split between the API and the frontend is a lint rule rather than a convention.
Full changelog: v1.5.0...v1.5.1