1.3.0-rc.1

1.3.0-rc.1 - 2026-07-16

First release candidate for 1.3.0.

Added

• GET /api/config returns _rev; POST returns 409 if the config is stale.
• Toggles are keyboard-focusable with a focus ring.

Fixed

• Custom icon upload in the app form.
• A fifth dock app was accepted, then dropped.
• Saving from two admin tabs no longer discards a save.
• Health Check now says why it is unavailable.

Security

• Icon uploads now verify the file is really an image.

Full changelog: v1.2.0...v1.3.0-rc.1

1.2.0

1.2.0 - 2026-07-15

Adds demo mode, plus UI fixes and hardening.

Added

• Demo mode: DEMO_MODE=true serves a read-only sample dashboard, refuses writes, and makes no outbound requests. Off by default.

Changed

• Now Playing shows the player the session is running on.
• Admin list: folders and widgets show their own icons, and only apps can be dragged into a folder.

Fixed

• The mobile search pill, activity badges, and results rendered at double size and overlapped the last widget row.
• The desktop search overlay had an empty band above the first result and a stranded close button with no Cancel.
• The backup card placeholder shifted on hover, leaving a blank band and clipping the next-run line.
• The now-playing strand appeared detached from the tape spool.

Security

• Hardened esc() and the uploaded-SVG sanitizer.

Full changelog: v1.1.0...v1.2.0

1.2.0-rc.4

1.2.0-rc.4 - 2026-07-15

Fourth release candidate for 1.2.0.

Changed

• Now Playing shows the player the session is running on.
• Demo dashboard: Books widget, a second disk, readable Vaultwarden and Prowlarr tiles, and the tape now winds.

Fixed

• The desktop search showed the mobile layout, an empty band above the first result, and no Cancel button.
• The mobile search pill and badges rendered at double size, and the pill covered the last row.

Full changelog: v1.2.0-rc.3...v1.2.0-rc.4

1.2.0-rc.3

1.2.0-rc.3 - 2026-07-15

Third release candidate for 1.2.0.

Changed

• Demo dashboard: more apps and a Downloads folder.

Fixed

• Demo app icons and favicon.
• The backup card placeholder shifted on hover, left a blank band, and clipped the next-run line.
• The now-playing strand looked detached from the spool.

Full changelog: v1.2.0-rc.2...v1.2.0-rc.3

1.2.0-rc.2

1.2.0-rc.2 - 2026-07-14

Second release candidate for 1.2.0.

Changed

• Reworked the sample dashboard: default dark tiles, small widgets, a four-app dock, and bundled wallpaper.

Fixed

• The backup widget rendered empty in the demo dashboard.

Full changelog: v1.2.0-rc.1...v1.2.0-rc.2

1.2.0-rc.1

1.2.0-rc.1 - 2026-07-14

First release candidate for 1.2.0. Adds demo mode. Off by default.

Added

• Demo mode: DEMO_MODE=true serves a read-only sample dashboard with fake widget activity, blocks all writes, and makes no outbound requests.

Changed

• Admin list: folders and widgets show their own icons, and only apps can be dragged into a folder.

Security

• Fixed DOM-XSS and SVG sanitization findings from code scanning.

Full changelog: v1.1.0...v1.2.0-rc.1

1.1.0

1.1.0 - 2026-07-13

Security and secret-handling hardening. Everyone logs in once after updating.

Changed

• Widget secret handling is unified on the manifest-driven path; widgets declare their secrets in widget.json.

Removed

• A dead touch-cleanup variable in the dashboard.

Fixed

• Two docs typos.

Security

• Backup widget instance passwords are now stripped from the config sent to the browser and on export.
• Scrutiny and network-speed widget data routes now apply the same SSRF guard and IP pinning as the rest of the proxy. A widget pointed at a private IP literal needs ALLOW_PRIVATE_IPS=true.
• Sessions now expire after a configurable lifetime (default 30 days, set with SESSION_MAX_AGE_DAYS). Existing sessions are invalidated, so everyone logs in once more after updating.
• esc() now escapes single quotes.

Full changelog: v1.0.0...v1.1.0

1.1.0-rc.2

1.1.0-rc.2 - 2026-07-13

Second release candidate for 1.1.0. Everyone logs in once after updating; a backup or speed widget on a private IP literal needs ALLOW_PRIVATE_IPS=true.

Changed

• Widget secret handling unified on the manifest path; CI and docs housekeeping.

Security

• Backup widget passwords are now stripped from the config sent to the browser and on export. They were returned in plaintext.
• The Scrutiny and network-speed routes are now SSRF-guarded and IP-pinned like the rest of the proxy.
• Sessions now expire (default 30 days, SESSION_MAX_AGE_DAYS).
• Further esc() hardening.

Full changelog: v1.1.0-rc.1...v1.1.0-rc.2

1.1.0-rc.1

1.1.0-rc.1 - 2026-07-13

Release candidate for 1.1.0. The new token format invalidates existing sessions, so everyone logs in once after updating.

Removed

• A dead touch-cleanup variable in the dashboard.

Fixed

• Two docs typos.

Security

• Sessions now expire after a set lifetime (default 30 days, SESSION_MAX_AGE_DAYS); tokens carry a signed issued-at enforced server-side, closing the non-expiring-session issue.
• esc() now escapes single quotes, closing a gap for single-quoted HTML attributes.

Full changelog: v1.0.0...v1.1.0-rc.1

1.0.0

1.0.0 - 2026-07-12

First public release. Stackyard serves plain HTTP and is built for a trusted LAN, not direct public exposure; see docs/security.md before exposing it further.

Added

• Launcher grid of apps, folders, and widgets, with a mobile layout.
• Widgets: Clock, Now Playing, Weather, DNS, GitHub, Books, System Stats, Disk Health, Backup, Connections, Dashboard Switch.
• Live activity badges from any API, configured in the UI.
• Admin UI with config import/export.
• Six languages, including RTL.
• SSRF-guarded requests with DNS-rebind protection, a non-root container, multi-arch images (amd64/arm64), and optional password protection.

Full changelog: https://github.com/SandObserver/stackyard/releases/tag/v1.0.0