1.6.0-rc.2

ghcr.io/sandobserver/stackyard:1.6.0-rc.2

1.6.0-rc.2 - 2026-08-12

Second release candidate for 1.6.0: 56 changes since 1.5.2, 17 of them new since rc.1. The headline is still importing an existing gethomepage or Dashy config. New in this candidate: the dashboard and Settings adapt to tablets, touch and large screens, widgets no longer poll in lockstep, and community icons are served through Stackyard instead of a public CDN.

This is a pre-release for testing and is not published to the demo. Worth exercising: importing a real config, the dashboard and Settings on a tablet and on a large screen, reordering Settings rows by touch, a dashboard with several widgets left running, and any badge or widget that stores a credential.

Before upgrading: sessions now expire after 12 hours idle rather than 30 days, so everyone signs in again (override with SESSION_MAX_AGE_DAYS). Requests that change something must send an Origin header, which affects scripts calling the API directly. The API listens on loopback only and can no longer be reached around Nginx. A stored credential is bound to the request it was saved for, so changing where a badge or widget sends it means entering it again. Allowing a self-signed certificate now applies only to addresses on your own network, so anything pointed at a public address needs a trusted certificate.

Added

• Import links and folders from a gethomepage or Dashy YAML config.
• The Docker Hub repository description is published from README.md on each stable release.
• The support documentation describes the log format, the level abbreviations and how to read the logs.

Changed

• Dashboard tiles scale with the window, so six columns stay square on a tablet and fill the width of a large screen.
• Settings keeps its sidebar on a tablet, narrowed.
• Widgets spread their polling, so several on one dashboard no longer fetch from your services on the same tick.
• Importing from another dashboard reads a list written level with its key, a value folded across lines, and an empty [] or {}, each of which used to refuse the whole file.
• Confirming an import and naming a new folder use in-page dialogs instead of the browser's own.
• The container prints six lines when it starts, instead of twenty-three.
• Nginx request errors now appear in docker logs, and Nginx no longer writes an access log to a file inside the container that nothing rotated.
• A misconfigured TRUST_PROXY produces one short warning instead of two long ones.

Fixed

• Resizing a browser window across the mobile breakpoint now switches the dashboard layout, instead of keeping the old one until a reload.
• Dragging a Settings row to reorder it now works by touch on a tablet.
• Controls in Settings reach the 44px minimum on a touch device.
• Settings respects the notch and home indicator when installed as a PWA.
• One unreachable service no longer delays every other tile's refresh by six seconds.
• A badge whose service did not answer keeps its last value and is marked out of date, instead of showing nothing.
• Icons from the community set are fetched once through Stackyard and kept in memory, instead of being loaded from a public CDN on every page load.
• A badge blocked for pointing at a private address now names ALLOW_PRIVATE_IPS=true as the setting that allows it.
• An Admin save no longer changes the Unsplash wallpaper on every open dashboard. The photo is kept for a day.
• The dashboard reopens on the page you were last on instead of the first one.
• The Docker socket proxy address is checked when it is saved, and a wrong one is refused with the reason and what to change about it, instead of being stored.
• The icon preview in the app editor keeps its inset and no longer reverts to the initial letter while an icon name is being typed.
• Exporting the config now reports a failure instead of saving an error response as stackyard-config.json.
• A session that expires while you are working in Admin now raises the sign-in box over the page, and the interrupted save completes once you are back in, instead of failing as "Unauthorised" until the page is reloaded.
• Saving an app or widget no longer reports "Updated" when the write failed; the editor stays open with the form intact.
• A failed save no longer leaves the admin list showing a delete, reorder, drag-drop or folder change the server never received.
• Importing a config reports "Imported" only once the write has landed.
• A failed label-visibility toggle now reports the error instead of failing silently with the switch left in its new position.
• A settings save that is refused for a missing or weak password no longer saves the rest of the screen first.
• The Password Protection switch is read back from the server after a save, so it no longer shows a state the server rejected.
• The Books, Now Playing and Backup widgets now show why they failed, such as a missing API key or a rejected password, instead of a generic error.
• The last visible row in a Settings group no longer draws a separator under itself, which showed under Password Protection whenever protection was off.
• The startup banner no longer prints a Web UI address that pointed at the internal API port and worked for nobody.
• The Connections map spreads a country's highlighted dots across it, clustered around the capital, instead of bunching them at the country's centre.
• Badges no longer lose their rounded shape in Safari after a long session.
• Turning Password Protection off now deletes the stored password. While protection is off, anyone who can reach the dashboard can set a new one.
• A password typed in the same save that turns Password Protection off is no longer stored and then immediately deleted, which signed out every other device for nothing.
• The sign-out row no longer stays on screen after Password Protection is turned off, where pressing it returned an error.
• The password and Unsplash key status labels are translated instead of always reading in English.
• Escape and the Tab trap keep working in a folder or prompt overlay after clicking text inside it.

Security

• Pages no longer permit stylesheets or fonts from Google Fonts, which nothing requests.
• The linux/arm64 release image is scanned for vulnerabilities before it is published, the same as linux/amd64.
• A stored credential is only reused for the request it was saved for. Changing where a badge or a widget sends it now requires entering it again.
• A tile colour that is not a colour no longer reaches a stylesheet, so a stored value cannot name a host for the browser to fetch from.
• An embedded widget is granted only presentation features, never camera, microphone or location, whatever its stored settings ask for.
• A badge no longer sends a header whose value is empty.
• The Password Protection switch refuses a request that does not plainly say on or off, instead of reading it as off and deleting the stored password.
• A Connections tile that cannot reach a service now says so in plain words instead of printing the address it tried, which put an internal host and port on the dashboard.
• A failed connection test no longer writes the request path to the log, where a service that carries its API key in the path would have left it.
• Allowing a self-signed certificate now applies only to addresses on your own network, wherever the request came from. A badge or health check pointed at a public address is verified again, so an app relying on this for one must use a trusted certificate.
• Importing from another dashboard asks before allowing self-signed certificates, instead of taking the setting from the file.
• Sessions now expire after 12 hours idle instead of 30 days, and a session in use is extended. Override with SESSION_MAX_AGE_DAYS.
• Requests that change something must state their origin. A script calling the API directly now has to send an Origin header naming the address it is calling.
• The API listens on loopback only, so it can no longer be reached around Nginx.
• The pre-login status reply no longer says whether a password has been set.