v1.6.1

1.6.1 (2026-11-15)

Bug Fixes

• api: a non-ASCII API key gets 401, not 500, on webhooks (#357) (fd42a9d), closes #301

v1.6.0

Before you upgrade

• Image rename. ghcr.io/strausmann/labelyard and docker.io/bstrausmann/labelyard replace the former image names. Update image: in your compose file. Settings are read as LABELYARD_*; PRINTER_HUB_* keeps working as a fallback and logs one warning that names the variables.
• Signatures. 1.6.0 images were signed before the repository was renamed, so their signing identity names the former repository. To verify with the documented cosign verify command, use 1.6.1 or later.
• SBOM. The CycloneDX SBOM of 1.6.0 is attached to the images as an attestation. The release asset could not be uploaded (immutable release); this is fixed for 1.6.1.

1.6.0 (2026-11-15)

Features

• config: read LABELYARD_* settings and keep PRINTER_HUB_* as a fallback (f98d38a)
• name the backend, CLI and API Labelyard (1feea1d)
• ui: list every shipped third-party licence on the about page (9f71334), closes #154
• web: show the Labelyard name, logo and tagline (286b54f)

Bug Fixes

• about: link pre-release builds to their commit, not a missing tag (b2d36c9), closes #327
• auth: name the bootstrap variable the deployment set (392a65e)
• brand: let users copy the verify commands, and cover the kept metric names in the guard (b9240b4), closes #348
• calibration: announce the pending note and say in the legend that inner corners have no marks (4162ce1), closes #348
• calibration: check a label corner against its own crossing only, and run the image test in CI (31fb54a), closes #348
• calibration: explain the disabled check button, keep focus on an enabled button, say the values stay (d9fcf60), closes #349
• calibration: leave out a label-corner mark that would come within the white of a tick (a1e96c4), closes #348 #348
• calibration: make the check print the obvious next step once a correction is stored (b874741), closes #349
• calibration: say so when the calibration page is pressed while it is still being queued (d78958d), closes #349
• calibration: serve the mini scale from the calibration routes, not the public info (04f30a6), closes #348
• calibration: space the mini scale ticks 0.5 mm apart and draw the app schematic to the same scale (a8d18d4), closes #348
• calibration: word the corner-mark legend for every sheet type; tighten the brand guard (2e8b663), closes #348
• config: keep input values out of the DEBUG configuration error (3bbba4f)
• config: make the prefix rename hold in CI and for empty values (abcdfe0)
• docker: drop pip, setuptools and wheel from the runtime venv (f438b8c), closes #332
• docker: remove the base image's pip from the runtime stage (9535e73), closes #332
• docs: close the review holes in the prose rules (e8a9d78)
• logs: satisfy lint line length and brand guard (61c0329), closes #324
• logs: write application warnings to the container output (463e6e2), closes #324
• pwa: let the server answer /frontend.cdx.json (7304be2)
• sheets: allow QR codes on 10 mm labels by default (47c7f56), closes #330
• ui: cap the licence list, handle load errors, name every button (7568028), closes #154
• ui: close the sheet type list on Escape while nothing is chosen (db54ed9), closes #318 #322
• ui: draw the sidebar as one fixed box without a scroller inside (0fde66d), closes #341
• ui: drop the obsolete catalogue entries of the calibration page (1fb405e), closes #349
• ui: drop the obsolete licence text catalogue entries (1d690d8), closes #154
• ui: give dialogs a close button and close them with one tap outside (c32bad1), closes #318
• ui: group equal cells in the sheet preview list and drop the shortened-text line (1643704), closes #150
• ui: keep focused rows clear of the bars, search field with a clear button (31f632c), closes #154
• ui: list each earlier print once and sum it up per item (83494e8), closes #340
• ui: name the bootstrap variable the deployment set (e7c652e)
• ui: offer to try the preview again once it stops asking by itself (7f0e8f0), closes #339
• ui: say how often an item was printed before when the list is cut (aea5e5f), closes #340
• ui: say in words when too many previews run and ask again by itself (cbdd33f), c...

v1.5.2

1.5.2 (2026-11-14)

Bug Fixes

• auth: log the prefix of a rejected API key escaped (#309) (e025aa2), closes #308

v1.5.1

1.5.1 (2026-11-13)

Bug Fixes

• api: report the hub version on every API response and in the event stream (74b5413), closes #288
• auth: bind a browser session signed in with a key to that key (bbb72e1), closes #294 #294
• auth: keep the default printer id out of /readiness, group only global IPv6 (eb672c3), closes #263
• auth: normalise limiter keys, record who printed, hide ids in 403s (7c03dd3), closes #263 #267
• auth: read a stored owner as a key only in its canonical form (73c0143), closes #294
• auth: store a key's last-used address in one spelling (d7300de), closes #263
• batches: let a key read its own sheet batches again (5badd21), closes #294
• batches: let only the submitting key act on its tape run (88a99fc)
• jobs: hide other keys' batches and printer queue jobs from a plain key (b9b1860), closes #294
• jobs: let only the submitting key see and act on its jobs (5726c2f), closes #294
• license: pin reportlab, keep licence files inside licenses/, answer 404 for NUL paths (7ef8fc1), closes #268
• print: admit small batches to a full printer, cap held runs per key (618d922)
• print: cap queued runs and previews, share copy payloads (60d3bc3)
• print: count held runs against their key only (752c5ba)
• print: discard only the submitting key's held runs (92a147f)
• printer-backends: use an underscore in the stored connection error code (#265) (e15abae)
• printer-backends: warning and report reasons never pause; validate stored connections (#265) (5c641a0)
• printers: close clients on failed stop, restart dead producers, one roll tracker per runtime (7732835)
• printers: test the producer retry under concurrency, close clients of failed builds (efe6122)
• printers: the roll tracker forgets a detached printer (204f435), closes #229
• printers: the tape print service knows its printer's slug (1021d79), closes #263
• print: owner is a required argument, and on_end cannot break the done callback (abb60f4), closes #293
• pwa: announce the update, keep the focus on its button, reload after a throwing check (bd84e57), closes #288
• pwa: reload after the takeover and when no new worker arrives in time (1a732f3), closes #288
• pwa: reload on the new version when the old worker holds the new one back (bf8567e), closes #288 #299
• pwa: reload on the new version when the old worker holds the new one back (#304) (a6ea36e)
• ql: print the listing overflow marker as +N, without a word (a67619a)
• queue: keep the half cut of a recovered run, evict on its own tick (12f94e4)
• queue: quieter repeat of mark_done, and a stop that survives a dead eviction loop (528e8cd), closes #263
• queue: re-batch recovered runs, evict finished jobs, no pause spin (77a405f)
• release: use a commit-analyzer 13 compatible conventionalcommits preset (#271) (af9d459)
• sheets: a retry checks the sheet ID cell at the printer's new resolution too (a8dc967), closes #266
• sheets: bound every render owner to all slots but one (033eabd), closes #293
• sheets: count stuck renders per key and bound the wait for a slot (fc523af), closes #293
• sheets: discard needs admin, per-entry seed, explicit ID cell flag (#264) (720fcf0), closes #266
• sheets: do not lock all callers without a key after one stuck render (8c8ce5a), closes #293
• sheets: enforce the write lock as the first statement of its transaction (cd78717), closes #264
• sheets: give callers without a key their own render semaphore (cc3438d), closes #293
• sheets: keep cells of held jobs whose end was not written (30838c3), closes #263 #266
• sheets: keep the preview slot of a key until its stuck render ends (cb72c92), closes #293
• **sheet...

v1.5.0

1.5.0 (2026-11-11)

Upgrade notes

• API paths: every API route now lives under /api/v1/; the old paths are not aliased. QR links, health, readiness and the API docs stay unversioned. Update API clients and webhook targets (Grocy, Spoolman, scripts).
• PROXY_IP is required in the Traefik, Caddy and Pangolin compose examples. The hub trusts X-Forwarded-For only from that one fixed address (no subnet, no wildcard); set it to your proxy's address before you redeploy, or docker compose refuses to start the stack.
• Printer-restricted keys: a print key restricted to printers other than the default tape printer can no longer use POST /api/v1/print or POST /api/v1/printer/resume (403 printer_not_allowed).
• Pending jobs: jobs that were queued before the upgrade are rendered again when they print.
• Device swaps: after the first status probe each printer remembers its hardware identity. If a different device answers at the same address, sheet and calibration pages wait until an admin resolves the swap in the printer view.

Security audits run 17 to 19 covered this release; deferred low and informational findings are tracked in #263.

Changes

• Merge pull request #278 from strausmann/milestone/1.5.0 (db5b4de), closes #278
• Merge remote-tracking branch 'origin/main' into feat/api-v1-status-manifest (67603d0)
• fix(api): bracket IPv6 hosts once in the test print URL and log a dropped QR (#228) (0373a44), closes #228
• fix(auth): bound and validate the sign-in limiter; no wildcard forwarded IPs in examples (9409198), closes #153
• fix(auth): enforce per-printer access on the legacy print routes (b179950), closes #153
• fix(batches): keep earlier confirmations when a run is reprinted again (#277) (b2bf30f), closes #277
• fix(examples): trust only the proxy fixed address for X-Forwarded-For (55bb30a), closes #153
• fix(print): free run pictures, flag every pre-send refusal, keep cards in step with the run (#277) (c5b079e), closes #277 #277
• fix(print): keep refused groups out of the unknown, hold the printer during a reprint, bound held ru (809e922), closes #277 #277
• fix(printers): apply printer create, update, enable and disable without a restart (#224) (eb15b1d), closes #224
• fix(printers): bind the swap resolution to the reviewed device and release the hold from the databas (0772477), closes #231
• fix(printers): keep the identity hold across a re-wire and settle review findings (#231) (4a7c39e), closes #231
• fix(printers): make the identity hold fail closed (#231) (0987b8d), closes #231
• fix(printers): never release the identity hold on an unverified clear (#231) (9670724), closes #231
• fix(printers): publish the status before the identity query and harden identity capture (#231) (c0f1e19), closes #231
• fix(ql): bound QL layout cost, mark cut text and refuse conflicting batches (#258) (358bc4b), closes #258 #258
• fix(ql): bound text layout work and label length (#258) (e3cfd7e), closes #258 #258
• fix(ql): lay QL labels across the tape width with a fixed QR size per tape (#258) (4512080), closes #258 #258
• fix(ql): pick the QR version per payload inside a fixed QR box (#258) (7ff1273), closes #258 #258
• fix(ql): store the QL layout default per printer and tape width (#258) (d22d098), closes #258 #258
• fix(queue): announce a run that waits for confirmation (#277) (6c6e0ad), closes #277
• fix(queue): serialize add and remove of the same printer (#224) (2af0888), closes #224
• fix(sheets): send the source URL to the issue only while it is the shipped one (#230) (49d82ee), closes #230
• fix(status): cover the IPP failure backoff in the bound and stop serving a stale tape (#227) (d046ecc), closes #227
• fix(status): make the roll write a compare-and-swap so a colour PUT cannot be lost (#229) (97d0c15), closes #229
• fix(status): one tape status schema; the tape endpoint works for SNMP-polled printers (#229) (e753718), closes #229
• fix(status): show a stale or unpolled printer status as unknown with its age (#227) (7ba92b6), closes #227
• fix(ui): a click starts a new sheet type search, the list stays above the tab bar (#237) (1d04d72), closes #237 #237
• fix(ui): announce a calibration print once and share one retry per job (#239) (fbff230), closes #239
• fix(ui): drop obsolete catalogue entries, give the colour Clear a context, finish the roll prompt (# (f46809d), closes #229
• fix(ui): drop the restart note from the printer settings (#224) (57cd990), closes #224
• fix(ui): harden the print status stack after review (#245) (e7a0685), closes #245
• fix(ui): import the mutation type as a type (#228) (d2513c4), closes #228
• fix(ui): keep held tape runs reachable and show a refused group as not printed (#277) (04f2d81), closes #277 #277
• fix(ui): keep identities from non-admins, announce only the swap sentence, say 'settled' outside the (1a52d99), closes #231
• fix(ui): keep the chosen sheet type when the calibration tray changes (#238) ([e81b48d](https://github.com/strausmann/Label-P...

v1.4.1

1.4.1 (2026-11-09)

• fix(ql): render QL labels at the printable width and shim Image.ANTIALIAS for brother_ql (#257) (c821bed), closes #257 #254 #254

v1.4.0

1.4.0 (2026-11-09)

• feat(ui): sheet archive, sheet printing, page jobs and calibration in the web UI (#216) (adc38a8), closes #216

v1.3.0

1.3.0 (2026-11-08)

• fix(api): release the session before submitting page jobs and validate the ID cell (#214) (1906ad8), closes #214 #210
• feat(api): IPP page printers, page jobs and per-tray calibration (#205) (5097158), closes #205 #150 #150
• feat(api): print labels onto die-cut sheets on page printers (#209) (c6b99d6), closes #209 #150 #150

v1.2.0

1.2.0 (2026-11-06)

• feat(api): sheet archive with versioned types, seed, numbered sheets and cell usage (#203) (7085e06), closes #203 #150
• docs(release): note the licence change in the 1.1.0 changelog (49bcf23), closes #154

v1.1.0

Licence: Releases up to and including 1.0.3 are MIT; from 1.1.0 on AGPL-3.0-or-later.

1.1.0 (2026-11-05)

• chore(license): relicense to AGPL-3.0-or-later (a661990), closes #154
• feat(api): project licence and source link of the running build (0989576), closes #154
• feat(ui): about page with licence and a link to the running version's source (8f15260), closes #154
• ci(security): licence policy with a dependency review gate and an image build check (#194) (fbde9b2), closes #194 #154