1.7.1

Changed

• docker-compose.yml now reads every operator setting from the environment, so
  a Docker UI's environment editor works without editing the file.

Fixed

• Import from another dashboard reads inline lists and mappings, environment
  placeholders, anchors on a value, and a comment after a quoted value.

• Import from another dashboard no longer refuses a whole file over one
  unreadable line. The line is listed in the preview and the rest is imported.

• Settings > About shows the version again, and the update link is translated.

• Serving a bundled icon no longer logs an nginx error.

• The home-screen icon is served on an install that has uploaded no icons.

• The TRUST_PROXY warning now gives an example value and where to set it.

---

Thanks to @ExXxtr3me for reporting #106.

1.7.0

Added

• Light theme for the Settings pages, with Settings Display Mode in Settings >
  Appearance: System Default, Light or Dark. Stored per device.

• Keep Screen Awake in Settings > Appearance, off by default. Needs HTTPS.

• Show From on a live activity badge, to badge only counts at or above a number.

• Install from Unraid Community Applications, with a template in templates/.

Changed

• Text on both pages now follows one type scale, so some sizes and line spacing
  shift slightly.

• Widget colours now match the rest of the app. Reds, blues, greens and greys
  that had been left on older values are corrected.

• Settings controls are redrawn: switches are wider with a capsule knob, slider
  tracks are thicker, and groups are more rounded.

• The wallpaper brightness slider now has the same handle as the colour sliders.

• Each colour slider handle shows the value it is set to.

• Group headings and their help text now line up with the settings above and
  below them.

• The settings sidebar is wider, with taller items and a rounded selection.

• The selected tab on a phone is marked with a pill instead of a coloured
  label.

• Widget tiles and dock icons are rounded correctly, and stay so at every icon
  and dashboard size.

• Either-or settings are now a segmented control instead of radio dots.

• Buttons in a dialog are taller and rounded.

• A long settings label now keeps its line and the value beside it shortens,
  instead of the label breaking in two.

• Unsplash API Key is now just API Key, under a Source row that already names
  Unsplash.

• Row separators now start level with the row's label instead of spanning the
  full width.

• Settings on a phone use the larger phone text size. On a desktop the panel
  keeps its denser size.

• Widgets on a page you are not looking at now poll four times less often, and
  refresh when you swipe back to them.

• Badge and health targets that keep failing are contacted less often, so an
  offline service no longer slows every other tile on every refresh.

• Scripts and stylesheets are now cached for a year instead of revalidated on
  every load. Their URLs change whenever the file does.

• The logo is redrawn, and its arc now follows the accent colour.

Fixed

• Home screen no longer leaves a dead strip below the dock in a home-screen
  install on iOS.

• App icons now use the current logo, and the browser tab icon follows the
  light or dark theme.

• Colour and brightness slider tracks draw round ends on a touch device instead
  of tapering to a point.

• Hue, saturation and brightness sliders no longer stretch across the row on a
  phone.

• Slider fills and colour ramps now run the same way as the handle in
  right-to-left languages.

• Saturation, brightness and wallpaper brightness sliders now draw a thin track
  on a phone, matching hue.

• Settings no longer flashes the desktop sidebar before the phone layout
  appears.

• Dock and the Settings tab bar now sit as close to the bottom of the screen as
  to the sides.

• Remove the stray Support link from Settings > General.

• App title toggles in Settings > Appearance now persist across a reload.

• Connections map tooltips now use the system font on Android, Windows and
  Linux instead of falling back to a serif.

• Saving on Settings > Appearance no longer reports "Wallpaper saved" when
  something else on the page was saved.

• The login and set-password screens, the phone tab bar, the logging level and
  wallpaper source menus, the version line and the app, widget and widget
  configuration forms are now translated instead of always showing English.

1.6.1

ghcr.io/sandobserver/stackyard:1.6.1

1.6.1 - 2026-08-14

Five fixes since 1.6.0, all on the phone layout and on badges. Nothing to do before upgrading.

Fixed

• Phone home screen no longer starts under the status bar in a home-screen install. The first row clears the clock and the island.
• Settings reserves the status bar area on a phone.
• Notification badges inside a folder no longer get trimmed at the page edge or bleed into the next page.
• Opening a folder no longer puts a focus ring on the first app, on a phone or on the desktop.
• A badge extract path ending in count now reads a JSON field of that name. It only counts an array when the value is an array.

1.6.0

ghcr.io/sandobserver/stackyard:1.6.0

1.6.0 - 2026-08-13

56 changes since 1.5.2. The headline is importing an existing gethomepage or Dashy config. The rest tightens what Admin does when a save fails, what a stored credential is allowed to reach, and how the dashboard sizes itself on a tablet.

Before upgrading: sessions now expire after 12 hours idle rather than 30 days, so everyone signs in again (override with SESSION_MAX_AGE_DAYS). Requests that change something must send an Origin header, which affects scripts calling the API directly. The API listens on loopback only and can no longer be reached around Nginx. A stored credential is bound to the request it was saved for, so changing where a badge or widget sends it means entering it again. Allowing a self-signed certificate now applies only to addresses on your own network, so anything pointed at a public address needs a trusted certificate.

Added

• Import links and folders from a gethomepage or Dashy YAML config.
• The Docker Hub repository description is published from README.md on each stable release.
• The support documentation describes the log format, the level abbreviations and how to read the logs.

Changed

• Dashboard tiles scale down with the window, so six columns stay square on a tablet. Sizes above the design width are unchanged.
• Settings keeps its sidebar on a tablet, narrowed.
• Widgets spread their polling, so several on one dashboard no longer fetch from your services on the same tick.
• Importing from another dashboard reads a list written level with its key, a value folded across lines, and an empty [] or {}, each of which used to refuse the whole file.
• Confirming an import and naming a new folder use in-page dialogs instead of the browser's own.
• The container prints six lines when it starts, instead of twenty-three.
• Nginx request errors now appear in docker logs, and Nginx no longer writes an access log to a file inside the container that nothing rotated.
• A misconfigured TRUST_PROXY produces one short warning instead of two long ones.

Fixed

• Resizing a browser window across the mobile breakpoint now switches the dashboard layout, instead of keeping the old one until a reload.
• Dragging a Settings row to reorder it now works by touch on a tablet.
• Controls in Settings reach the 44px minimum on a touch device.
• Settings respects the notch and home indicator when installed as a PWA.
• One unreachable service no longer delays every other tile's refresh by six seconds.
• A badge whose service did not answer keeps its last value and is marked out of date, instead of showing nothing.
• Icons from the community set are fetched once through Stackyard and kept in memory, instead of being loaded from a public CDN on every page load.
• A badge blocked for pointing at a private address now names ALLOW_PRIVATE_IPS=true as the setting that allows it.
• An Admin save no longer changes the Unsplash wallpaper on every open dashboard. The photo is kept for a day.
• The dashboard reopens on the page you were last on instead of the first one.
• The Docker socket proxy address is checked when it is saved, and a wrong one is refused with the reason and what to change about it, instead of being stored.
• The icon preview in the app editor keeps its inset and no longer reverts to the initial letter while an icon name is being typed.
• Exporting the config now reports a failure instead of saving an error response as stackyard-config.json.
• A session that expires while you are working in Admin now raises the sign-in box over the page, and the interrupted save completes once you are back in, instead of failing as "Unauthorised" until the page is reloaded.
• Saving an app or widget no longer reports "Updated" when the write failed; the editor stays open with the form intact.
• A failed save no longer leaves the admin list showing a delete, reorder, drag-drop or folder change the server never received.
• Importing a config reports "Imported" only once the write has landed.
• A failed label-visibility toggle now reports the error instead of failing silently with the switch left in its new position.
• A settings save that is refused for a missing or weak password no longer saves the rest of the screen first.
• The Password Protection switch is read back from the server after a save, so it no longer shows a state the server rejected.
• The Books, Now Playing and Backup widgets now show why they failed, such as a missing API key or a rejected password, instead of a generic error.
• The last visible row in a Settings group no longer draws a separator under itself, which showed under Password Protection whenever protection was off.
• The startup banner no longer prints a Web UI address that pointed at the internal API port and worked for nobody.
• The Connections map spreads a country's highlighted dots across it, clustered around the capital, instead of bunching them at the country's centre.
• Badges no longer lose their rounded shape in Safari after a long session.
• Turning Password Protection off now deletes the stored password. While protection is off, anyone who can reach the dashboard can set a new one.
• A password typed in the same save that turns Password Protection off is no longer stored and then immediately deleted, which signed out every other device for nothing.
• The sign-out row no longer stays on screen after Password Protection is turned off, where pressing it returned an error.
• The password and Unsplash key status labels are translated instead of always reading in English.
• Escape and the Tab trap keep working in a folder or prompt overlay after clicking text inside it.

Security

• Pages no longer permit stylesheets or fonts from Google Fonts, which nothing requests.
• The linux/arm64 release image is scanned for vulnerabilities before it is published, the same as linux/amd64.
• A stored credential is only reused for the request it was saved for. Changing where a badge or a widget sends it now requires entering it again.
• A tile colour that is not a colour no longer reaches a stylesheet, so a stored value cannot name a host for the browser to fetch from.
• An embedded widget is granted only presentation features, never camera, microphone or location, whatever its stored settings ask for.
• A badge no longer sends a header whose value is empty.
• The Password Protection switch refuses a request that does not plainly say on or off, instead of reading it as off and deleting the stored password.
• A Connections tile that cannot reach a service now says so in plain words instead of printing the address it tried, which put an internal host and port on the dashboard.
• A failed connection test no longer writes the request path to the log, where a service that carries its API key in the path would have left it.
• Allowing a self-signed certificate now applies only to addresses on your own network, wherever the request came from. A badge or health check pointed at a public address is verified again, so an app relying on this for one must use a trusted certificate.
• Importing from another dashboard asks before allowing self-signed certificates, instead of taking the setting from the file.
• Sessions now expire after 12 hours idle instead of 30 days, and a session in use is extended. Override with SESSION_MAX_AGE_DAYS.
• Requests that change something must state their origin. A script calling the API directly now has to send an Origin header naming the address it is calling.
• The API listens on loopback only, so it can no longer be reached around Nginx.
• The pre-login status reply no longer says whether a password has been set.

1.6.0-rc.2

ghcr.io/sandobserver/stackyard:1.6.0-rc.2

1.6.0-rc.2 - 2026-08-12

Second release candidate for 1.6.0: 56 changes since 1.5.2, 17 of them new since rc.1. The headline is still importing an existing gethomepage or Dashy config. New in this candidate: the dashboard and Settings adapt to tablets, touch and large screens, widgets no longer poll in lockstep, and community icons are served through Stackyard instead of a public CDN.

This is a pre-release for testing and is not published to the demo. Worth exercising: importing a real config, the dashboard and Settings on a tablet and on a large screen, reordering Settings rows by touch, a dashboard with several widgets left running, and any badge or widget that stores a credential.

Before upgrading: sessions now expire after 12 hours idle rather than 30 days, so everyone signs in again (override with SESSION_MAX_AGE_DAYS). Requests that change something must send an Origin header, which affects scripts calling the API directly. The API listens on loopback only and can no longer be reached around Nginx. A stored credential is bound to the request it was saved for, so changing where a badge or widget sends it means entering it again. Allowing a self-signed certificate now applies only to addresses on your own network, so anything pointed at a public address needs a trusted certificate.

Added

• Import links and folders from a gethomepage or Dashy YAML config.
• The Docker Hub repository description is published from README.md on each stable release.
• The support documentation describes the log format, the level abbreviations and how to read the logs.

Changed

• Dashboard tiles scale with the window, so six columns stay square on a tablet and fill the width of a large screen.
• Settings keeps its sidebar on a tablet, narrowed.
• Widgets spread their polling, so several on one dashboard no longer fetch from your services on the same tick.
• Importing from another dashboard reads a list written level with its key, a value folded across lines, and an empty [] or {}, each of which used to refuse the whole file.
• Confirming an import and naming a new folder use in-page dialogs instead of the browser's own.
• The container prints six lines when it starts, instead of twenty-three.
• Nginx request errors now appear in docker logs, and Nginx no longer writes an access log to a file inside the container that nothing rotated.
• A misconfigured TRUST_PROXY produces one short warning instead of two long ones.

Fixed

• Resizing a browser window across the mobile breakpoint now switches the dashboard layout, instead of keeping the old one until a reload.
• Dragging a Settings row to reorder it now works by touch on a tablet.
• Controls in Settings reach the 44px minimum on a touch device.
• Settings respects the notch and home indicator when installed as a PWA.
• One unreachable service no longer delays every other tile's refresh by six seconds.
• A badge whose service did not answer keeps its last value and is marked out of date, instead of showing nothing.
• Icons from the community set are fetched once through Stackyard and kept in memory, instead of being loaded from a public CDN on every page load.
• A badge blocked for pointing at a private address now names ALLOW_PRIVATE_IPS=true as the setting that allows it.
• An Admin save no longer changes the Unsplash wallpaper on every open dashboard. The photo is kept for a day.
• The dashboard reopens on the page you were last on instead of the first one.
• The Docker socket proxy address is checked when it is saved, and a wrong one is refused with the reason and what to change about it, instead of being stored.
• The icon preview in the app editor keeps its inset and no longer reverts to the initial letter while an icon name is being typed.
• Exporting the config now reports a failure instead of saving an error response as stackyard-config.json.
• A session that expires while you are working in Admin now raises the sign-in box over the page, and the interrupted save completes once you are back in, instead of failing as "Unauthorised" until the page is reloaded.
• Saving an app or widget no longer reports "Updated" when the write failed; the editor stays open with the form intact.
• A failed save no longer leaves the admin list showing a delete, reorder, drag-drop or folder change the server never received.
• Importing a config reports "Imported" only once the write has landed.
• A failed label-visibility toggle now reports the error instead of failing silently with the switch left in its new position.
• A settings save that is refused for a missing or weak password no longer saves the rest of the screen first.
• The Password Protection switch is read back from the server after a save, so it no longer shows a state the server rejected.
• The Books, Now Playing and Backup widgets now show why they failed, such as a missing API key or a rejected password, instead of a generic error.
• The last visible row in a Settings group no longer draws a separator under itself, which showed under Password Protection whenever protection was off.
• The startup banner no longer prints a Web UI address that pointed at the internal API port and worked for nobody.
• The Connections map spreads a country's highlighted dots across it, clustered around the capital, instead of bunching them at the country's centre.
• Badges no longer lose their rounded shape in Safari after a long session.
• Turning Password Protection off now deletes the stored password. While protection is off, anyone who can reach the dashboard can set a new one.
• A password typed in the same save that turns Password Protection off is no longer stored and then immediately deleted, which signed out every other device for nothing.
• The sign-out row no longer stays on screen after Password Protection is turned off, where pressing it returned an error.
• The password and Unsplash key status labels are translated instead of always reading in English.
• Escape and the Tab trap keep working in a folder or prompt overlay after clicking text inside it.

Security

• Pages no longer permit stylesheets or fonts from Google Fonts, which nothing requests.
• The linux/arm64 release image is scanned for vulnerabilities before it is published, the same as linux/amd64.
• A stored credential is only reused for the request it was saved for. Changing where a badge or a widget sends it now requires entering it again.
• A tile colour that is not a colour no longer reaches a stylesheet, so a stored value cannot name a host for the browser to fetch from.
• An embedded widget is granted only presentation features, never camera, microphone or location, whatever its stored settings ask for.
• A badge no longer sends a header whose value is empty.
• The Password Protection switch refuses a request that does not plainly say on or off, instead of reading it as off and deleting the stored password.
• A Connections tile that cannot reach a service now says so in plain words instead of printing the address it tried, which put an internal host and port on the dashboard.
• A failed connection test no longer writes the request path to the log, where a service that carries its API key in the path would have left it.
• Allowing a self-signed certificate now applies only to addresses on your own network, wherever the request came from. A badge or health check pointed at a public address is verified again, so an app relying on this for one must use a trusted certificate.
• Importing from another dashboard asks before allowing self-signed certificates, instead of taking the setting from the file.
• Sessions now expire after 12 hours idle instead of 30 days, and a session in use is extended. Override with SESSION_MAX_AGE_DAYS.
• Requests that change something must state their origin. A script calling the API directly now has to send an Origin header naming the address it is calling.
• The API listens on loopback only, so it can no longer be reached around Nginx.
• The pre-login status reply no longer says whether a password has been set.

1.6.0-rc.1

ghcr.io/sandobserver/stackyard:1.6.0-rc.1

1.6.0-rc.1 - 2026-08-12

Release candidate for 1.6.0: 39 changes since 1.5.2. The headline is importing an existing gethomepage or Dashy config, and most of the rest tightens what Admin does when a save fails and what a stored credential is allowed to reach.

This is a pre-release for testing and is not published to the demo. Worth exercising: importing a real config, saving in Admin while signed out or offline, and any badge or widget that stores a credential.

Before upgrading: sessions now expire after 12 hours idle rather than 30 days, so everyone signs in again (override with SESSION_MAX_AGE_DAYS). Requests that change something must send an Origin header, which affects scripts calling the API directly. The API listens on loopback only and can no longer be reached around Nginx. A stored credential is bound to the request it was saved for, so changing where a badge or widget sends it means entering it again. Allowing a self-signed certificate now applies only to addresses on your own network, so anything pointed at a public address needs a trusted certificate.

Added

• Import links and folders from a gethomepage or Dashy YAML config.
• The Docker Hub repository description is published from README.md on each stable release.
• The support documentation describes the log format, the level abbreviations and how to read the logs.

Changed

• Importing from another dashboard reads a list written level with its key, a value folded across lines, and an empty [] or {}, each of which used to refuse the whole file.
• Confirming an import and naming a new folder use in-page dialogs instead of the browser's own.
• The container prints six lines when it starts, instead of twenty-three.
• Nginx request errors now appear in docker logs, and Nginx no longer writes an access log to a file inside the container that nothing rotated.
• A misconfigured TRUST_PROXY produces one short warning instead of two long ones.

Fixed

• Exporting the config now reports a failure instead of saving an error response as stackyard-config.json.
• A session that expires while you are working in Admin now raises the sign-in box over the page, and the interrupted save completes once you are back in, instead of failing as "Unauthorised" until the page is reloaded.
• Saving an app or widget no longer reports "Updated" when the write failed; the editor stays open with the form intact.
• A failed save no longer leaves the admin list showing a delete, reorder, drag-drop or folder change the server never received.
• Importing a config reports "Imported" only once the write has landed.
• A failed label-visibility toggle now reports the error instead of failing silently with the switch left in its new position.
• A settings save that is refused for a missing or weak password no longer saves the rest of the screen first.
• The Password Protection switch is read back from the server after a save, so it no longer shows a state the server rejected.
• The Books, Now Playing and Backup widgets now show why they failed, such as a missing API key or a rejected password, instead of a generic error.
• The last visible row in a Settings group no longer draws a separator under itself, which showed under Password Protection whenever protection was off.
• The startup banner no longer prints a Web UI address that pointed at the internal API port and worked for nobody.
• The Connections map spreads a country's highlighted dots across it, clustered around the capital, instead of bunching them at the country's centre.
• Badges no longer lose their rounded shape in Safari after a long session.
• Turning Password Protection off now deletes the stored password. While protection is off, anyone who can reach the dashboard can set a new one.
• A password typed in the same save that turns Password Protection off is no longer stored and then immediately deleted, which signed out every other device for nothing.
• The sign-out row no longer stays on screen after Password Protection is turned off, where pressing it returned an error.
• The password and Unsplash key status labels are translated instead of always reading in English.
• Escape and the Tab trap keep working in a folder or prompt overlay after clicking text inside it.

Security

• A stored credential is only reused for the request it was saved for. Changing where a badge or a widget sends it now requires entering it again.
• A tile colour that is not a colour no longer reaches a stylesheet, so a stored value cannot name a host for the browser to fetch from.
• An embedded widget is granted only presentation features, never camera, microphone or location, whatever its stored settings ask for.
• A badge no longer sends a header whose value is empty.
• The Password Protection switch refuses a request that does not plainly say on or off, instead of reading it as off and deleting the stored password.
• A Connections tile that cannot reach a service now says so in plain words instead of printing the address it tried, which put an internal host and port on the dashboard.
• A failed connection test no longer writes the request path to the log, where a service that carries its API key in the path would have left it.
• Allowing a self-signed certificate now applies only to addresses on your own network, wherever the request came from. A badge or health check pointed at a public address is verified again, so an app relying on this for one must use a trusted certificate.
• Importing from another dashboard asks before allowing self-signed certificates, instead of taking the setting from the file.
• Sessions now expire after 12 hours idle instead of 30 days, and a session in use is extended. Override with SESSION_MAX_AGE_DAYS.
• Requests that change something must state their origin. A script calling the API directly now has to send an Origin header naming the address it is calling.
• The API listens on loopback only, so it can no longer be reached around Nginx.
• The pre-login status reply no longer says whether a password has been set.

Full changelog: v1.5.2...v1.6.0-rc.1

1.5.2

ghcr.io/sandobserver/stackyard:1.5.2

Changed

• Finishing first-run setup on an install with nothing on the dashboard now opens Settings, where the first app or widget is added, instead of an empty dashboard.

Fixed

• Disk Health, System Stats, Backup, Now Playing and the two Connections views now show why a widget failed instead of an HTTP status or a generic message.
• The admin save toast now carries its success or failure as a coloured fill that meets WCAG AA, instead of a thin accent bar on one edge.

Security

• The image no longer ships Python setuptools, which arrived as a packaging dependency of supervisor and nothing in the container used.

1.5.2-rc.1

Release candidate for 1.5.2. Not recommended for general use; latest still points at 1.5.1.

ghcr.io/sandobserver/stackyard:1.5.2-rc.1

Changed

• Finishing first-run setup on an install with nothing on the dashboard now opens Settings, where the first app or widget is added, instead of an empty dashboard.

Fixed

• Disk Health, System Stats, Backup, Now Playing and the two Connections views now show why a widget failed instead of an HTTP status or a generic message.
• The admin save toast now carries its success or failure as a coloured fill that meets WCAG AA, instead of a thin accent bar on one edge.

1.5.1

1.5.1 - 2026-08-08

A fix release. One item matters more than the rest: on 1.5.0, saving anything failed if you reached Stackyard directly on a mapped port. If you run it as http://your-server:8700 rather than behind a reverse proxy, upgrade.

Fixed

• Saving settings, logging in, and every other write now work when Stackyard is reached directly on a mapped port, such as http://server:8700. nginx forwarded a Host header with the port stripped while the browser's Origin kept it, so the two never matched and every write was refused as an origin mismatch. Only installs behind a reverse proxy on 443 were unaffected, which is how it survived 1.5.0.
• German, Spanish, French, Persian and Chinese translate a further 34 strings that were left as English in their catalogues.
• Admin translates the Dock, Health and Badge pills, the Edit button, the Secret checkbox, the colour and poll-interval labels, the widget Name and Widget Type labels, and the editor's section title. All were English in every language.
• The poll interval reads as one sentence in every language instead of wrapping the field in English words.
• App and widget names in the Settings list sit beside their icon in Persian instead of aligning to the far side of the row.
• The divider between the Settings navigation and the section beside it runs the full length of the section instead of stopping one screen down.
• The icon preview in the app editor no longer draws its artwork edge to edge.
• Colour swatches that wrap onto a second row line up under the row above instead of splitting to opposite edges.

Also published to Docker Hub

From this release, images are mirrored:

ghcr.io/sandobserver/stackyard:1.5.1
docker.io/sandobserver/stackyard:1.5.1

ghcr.io remains the one to prefer, and the one the signature below covers.

Verifying this release

cosign verify ghcr.io/sandobserver/stackyard:1.5.1 \
  --certificate-identity-regexp '^https://github.com/SandObserver/stackyard/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The build also scans the image with Trivy, failing on a fixable HIGH or CRITICAL, and attaches an SPDX SBOM. See docs/security.md.

For maintainers

• A Playwright suite drives the admin UI against the built image, in Chromium and WebKit. It found the origin bug on its first working run.
• Those browser tests run on pull requests that touch the interface, on every merge, and as a gate on the release: a tag can no longer publish an image they reject.
• Backend coverage is measured against a floor, the frontend path map is checked, formatting is enforced, and the module-system split between the API and the frontend is a lint rule rather than a convention.

Full changelog: v1.5.0...v1.5.1

1.5.1-rc.1

1.5.1-rc.1 - 2026-08-08

Candidate for 1.5.1. It carries one fix that matters more than the rest: writes were refused on any install reached directly on a mapped port.

Fixed

• Saving settings, logging in, and every other write now work when Stackyard is reached directly on a mapped port, such as http://server:8700. nginx forwarded a Host header with the port stripped while the browser's Origin kept it, so the two never matched and every write was refused as an origin mismatch. Only installs behind a reverse proxy on 443 were unaffected, which is why this survived 1.5.0.
• German, Spanish, French, Persian and Chinese translate a further 34 strings that were left as English in their catalogues.
• Admin translates the Dock, Health and Badge pills, the Edit button, the Secret checkbox, the colour and poll-interval labels, the widget Name and Widget Type labels, and the editor's section title.
• The poll interval reads as one sentence in every language instead of wrapping the field in English words.
• App and widget names in the Settings list sit beside their icon in Persian instead of aligning to the far side of the row.
• The divider between the Settings navigation and the section beside it runs the full length of the section instead of stopping one screen down.
• The icon preview in the app editor no longer draws its artwork edge to edge.
• Colour swatches that wrap onto a second row line up under the row above instead of splitting to opposite edges.

If you are testing this

The origin fix is the one to exercise. Browse your instance directly on its mapped port, not through a reverse proxy, and save something in Settings. On 1.5.0 that fails with "Forbidden: origin mismatch".

For maintainers

• A Playwright suite now drives the admin UI against the built image, in Chromium and WebKit. It found the origin bug on its first working run.
• Those browser tests run on pull requests that touch the interface, on every merge, and as a gate on the release itself: a tag can no longer publish an image they reject.
• Backend coverage is measured and floored, the frontend path map is checked, and formatting is enforced.
• This is the first release mirrored to Docker Hub as well as ghcr.io.

Full changelog: v1.5.0...v1.5.1-rc.1