Skip to content

1.6.0

Choose a tag to compare

View all tags
@SandObserver SandObserver released this 13 Aug 02:44
· 66 commits to main since this release
v1.6.0
0dd0a0a 
ghcr.io/sandobserver/stackyard:1.6.0

1.6.0 - 2026-08-13

56 changes since 1.5.2. The headline is importing an existing gethomepage or Dashy config. The rest tightens what Admin does when a save fails, what a stored credential is allowed to reach, and how the dashboard sizes itself on a tablet.

Before upgrading: sessions now expire after 12 hours idle rather than 30 days, so everyone signs in again (override with SESSION_MAX_AGE_DAYS). Requests that change something must send an Origin header, which affects scripts calling the API directly. The API listens on loopback only and can no longer be reached around Nginx. A stored credential is bound to the request it was saved for, so changing where a badge or widget sends it means entering it again. Allowing a self-signed certificate now applies only to addresses on your own network, so anything pointed at a public address needs a trusted certificate.

Added

  • Import links and folders from a gethomepage or Dashy YAML config.
  • The Docker Hub repository description is published from README.md on each stable release.
  • The support documentation describes the log format, the level abbreviations and how to read the logs.

Changed

  • Dashboard tiles scale down with the window, so six columns stay square on a tablet. Sizes above the design width are unchanged.
  • Settings keeps its sidebar on a tablet, narrowed.
  • Widgets spread their polling, so several on one dashboard no longer fetch from your services on the same tick.
  • Importing from another dashboard reads a list written level with its key, a value folded across lines, and an empty [] or {}, each of which used to refuse the whole file.
  • Confirming an import and naming a new folder use in-page dialogs instead of the browser's own.
  • The container prints six lines when it starts, instead of twenty-three.
  • Nginx request errors now appear in docker logs, and Nginx no longer writes an access log to a file inside the container that nothing rotated.
  • A misconfigured TRUST_PROXY produces one short warning instead of two long ones.

Fixed

  • Resizing a browser window across the mobile breakpoint now switches the dashboard layout, instead of keeping the old one until a reload.
  • Dragging a Settings row to reorder it now works by touch on a tablet.
  • Controls in Settings reach the 44px minimum on a touch device.
  • Settings respects the notch and home indicator when installed as a PWA.
  • One unreachable service no longer delays every other tile's refresh by six seconds.
  • A badge whose service did not answer keeps its last value and is marked out of date, instead of showing nothing.
  • Icons from the community set are fetched once through Stackyard and kept in memory, instead of being loaded from a public CDN on every page load.
  • A badge blocked for pointing at a private address now names ALLOW_PRIVATE_IPS=true as the setting that allows it.
  • An Admin save no longer changes the Unsplash wallpaper on every open dashboard. The photo is kept for a day.
  • The dashboard reopens on the page you were last on instead of the first one.
  • The Docker socket proxy address is checked when it is saved, and a wrong one is refused with the reason and what to change about it, instead of being stored.
  • The icon preview in the app editor keeps its inset and no longer reverts to the initial letter while an icon name is being typed.
  • Exporting the config now reports a failure instead of saving an error response as stackyard-config.json.
  • A session that expires while you are working in Admin now raises the sign-in box over the page, and the interrupted save completes once you are back in, instead of failing as "Unauthorised" until the page is reloaded.
  • Saving an app or widget no longer reports "Updated" when the write failed; the editor stays open with the form intact.
  • A failed save no longer leaves the admin list showing a delete, reorder, drag-drop or folder change the server never received.
  • Importing a config reports "Imported" only once the write has landed.
  • A failed label-visibility toggle now reports the error instead of failing silently with the switch left in its new position.
  • A settings save that is refused for a missing or weak password no longer saves the rest of the screen first.
  • The Password Protection switch is read back from the server after a save, so it no longer shows a state the server rejected.
  • The Books, Now Playing and Backup widgets now show why they failed, such as a missing API key or a rejected password, instead of a generic error.
  • The last visible row in a Settings group no longer draws a separator under itself, which showed under Password Protection whenever protection was off.
  • The startup banner no longer prints a Web UI address that pointed at the internal API port and worked for nobody.
  • The Connections map spreads a country's highlighted dots across it, clustered around the capital, instead of bunching them at the country's centre.
  • Badges no longer lose their rounded shape in Safari after a long session.
  • Turning Password Protection off now deletes the stored password. While protection is off, anyone who can reach the dashboard can set a new one.
  • A password typed in the same save that turns Password Protection off is no longer stored and then immediately deleted, which signed out every other device for nothing.
  • The sign-out row no longer stays on screen after Password Protection is turned off, where pressing it returned an error.
  • The password and Unsplash key status labels are translated instead of always reading in English.
  • Escape and the Tab trap keep working in a folder or prompt overlay after clicking text inside it.

Security

  • Pages no longer permit stylesheets or fonts from Google Fonts, which nothing requests.
  • The linux/arm64 release image is scanned for vulnerabilities before it is published, the same as linux/amd64.
  • A stored credential is only reused for the request it was saved for. Changing where a badge or a widget sends it now requires entering it again.
  • A tile colour that is not a colour no longer reaches a stylesheet, so a stored value cannot name a host for the browser to fetch from.
  • An embedded widget is granted only presentation features, never camera, microphone or location, whatever its stored settings ask for.
  • A badge no longer sends a header whose value is empty.
  • The Password Protection switch refuses a request that does not plainly say on or off, instead of reading it as off and deleting the stored password.
  • A Connections tile that cannot reach a service now says so in plain words instead of printing the address it tried, which put an internal host and port on the dashboard.
  • A failed connection test no longer writes the request path to the log, where a service that carries its API key in the path would have left it.
  • Allowing a self-signed certificate now applies only to addresses on your own network, wherever the request came from. A badge or health check pointed at a public address is verified again, so an app relying on this for one must use a trusted certificate.
  • Importing from another dashboard asks before allowing self-signed certificates, instead of taking the setting from the file.
  • Sessions now expire after 12 hours idle instead of 30 days, and a session in use is extended. Override with SESSION_MAX_AGE_DAYS.
  • Requests that change something must state their origin. A script calling the API directly now has to send an Origin header naming the address it is calling.
  • The API listens on loopback only, so it can no longer be reached around Nginx.
  • The pre-login status reply no longer says whether a password has been set.
Assets 2
Loading