Signed Windows MSI/portable, macOS DMG, and Docker appliance published for public download.

Hub federation, update depot, notify + confirm apply, and scheduled Windows apply in the always-on Business appliance.

Free portable session scanner + Business $40 per appliance. Zero device telemetry. Trust Center and About on the public site.

Feature and site development frozen as of July 13, 2026. Security and critical fixes may still ship as patches.

Why StacksAtlas exists: local-first craft, federation pivot, signing and LLC red tape, indie partnership pricing. Linked from nav, footer, and Trust Center.

Remote log abbreviations, offline Threshold WRN once-until-recovery, safer semver compare, Hub offer UX, Notify gated on staged depot, archive purge, depot re-stage warn.

Enrolled Nodes need compose build for Nmap image upgrades; recreate alone can keep an old layer.

Hub preview self-upgrade, Mac Notify + DMG, Linux Deep Scan rebuild to 1.9.4.

Network link / topology mapping, Hub depot updates, Watchtower compose on the site, federation 5002 firewall, OpenAVC and webhook Alert Scope guides.

Host-side auto-update for standalone Docker Business; Hub depot remains the air-gap path for enrolled Nodes.

Features/demo/FAQ cleanup, Free + Business $40 consistency, thin dark docs scrollbars.

Public stable promote checklist locked; first public stable remains an operator ship gate.

MSI and portable apply from Software Updates after checklist confirm.

DMG download path; Docker host pull / compose recreate commands (Watchtower for standalone hosts).

Uplink, SSID, location, and asset fields across Hub and Node with Human Property Shield.

Reconnect pulse, license mirror, onboarding loops, and Hub live alerts reliability.

Kind, port/SSID, and parent device with drawer fields, grid columns, and CSV export.

Hierarchical map with LAN/Wi-Fi styling, signal path highlight, and PNG/SVG export.

Backlog and MAC-first parent merge so Hub uplinks survive incomplete Node pushes.

Public /trust page, security docs cross-links, and sitemap / llms.txt updates.

Admin /audit trail with federation ingest and optional syslog forward.

Strict security-audit.ps1 checks and route policy refresh before promote.

Shipped plans moved to archive; living references trimmed for pre-publish review.

Installation, legal credits, and pricing copy checked against the Free + Business model.

Microsoft.OpenApi bumped to 2.9.0 (patches circular-schema DoS advisory).

Essential default columns, semantic status filters, toolbar two-row layout, bulk ping/scan/type actions.

Current view, full registry, asset fields, and import template. No jargon.

Inline edits survive auto-refresh; security tooltips and device-type icons improved.

Link inventory devices to OpenAVC, pin macros, run commands, and read device state (not the Activity log).

Fleet operators use the same drawer; credentials stay on the owning Node.

Control Bridge is Business-appliance only (403 in portable).

Hub and Node dashboards, devices, users, and alerts get dedicated mobile layouts under the md breakpoint.

Homelab pass across Windows, Mac, and Linux before the next trains.

Collapsible report sections, sticky export, and faster find-in-page for large inventories.

Docs and marketing copy tightened around Free portable + Business $40.

Stability and UX fixes on the 1.8 train before OpenAVC and mobile sweeps.

Release notes chip, pre-update checklist, scheduled maintenance apply, portable Business CTAs.

Hub opens enrolled macOS sites on HTTP :5050 (not :5000); federation API returns per-node ports.

Settings refresh for Free + Business ($40) two-tier model.

Documented anonymous API policy; SSO cookie handoff (no JWT in URL); same-origin CORS; auth rate limiting; Nmap target validation.

NuGet vulnerability scan + dotnet test in master-build; Dependabot for npm and NuGet.

Progress heartbeat during long Nmap runs; Hub federated status relay; Nmap+Npcap gating aligned with dashboard warnings.

Security route policy, lab-smoke.ps1, and close-out checklist for post-freeze operations.

2-tier GTM copy, docs alignment, Docker portable compose, optional Deep Scan guide.

Official image excludes Nmap (NPSL); optional Dockerfile.deep-scan.example.

PDF export requires auth; license activate gated post-onboarding; federation pulse token auth.

Notarized, stapled universal DMG with Install helper and menu bar companion.

Operator-validated universal lipo + DMG publish path for release artifacts.

Browser opens http://127.0.0.1:5000 (Win) or :5050 (Mac) without certificate warnings on first launch.

One-click trust for portable/MSI, manual .cer import, and platform-specific guidance in onboarding.

Settings → Infrastructure → Software Updates: one-click Windows MSI and portable upgrades from releases.stacksatlas.com.

Pre-update snapshot before MSI apply; portable uses launcher backup.

releases.stacksatlas.com stable and preview channels with signature verification.

GET /api/system/version and POST /api/system/updates/check; local publish pipeline (no GitHub Actions).

One-file StacksAtlas-Portable.exe: no admin, tray icon, Close & remove wipes data.

Run StacksAtlas.app without Install: session data in ~/StacksAtlas-Trial.

Per-device audit and risk grades included in free tier; no license key required.

Hub tailnet identity, node transport toggle, reachability diagnostics, and field-validated SignalR sync.

Archive, tombstones, remote site reset, and re-enrollment dedup across Hub and enrolled nodes.

Express onboarding wizard with tier entitlements and Business/Pro fleet gates.

Integrated npm audit directly into the master-build pipeline. The build now enforces a 'High-Severity Fail' policy, preventing insecure code from reaching production.

Resolved 10 high-severity vulnerabilities across the React toolchain (Vite, Rollup, and Next.js) to achieve a zero-vulnerability state.

Upgraded the documentation site to Next.js 16.2.6 and implemented package overrides to resolve critical CSRF and PostCSS XSS vulnerabilities.

Native payload formatting for Slack (Block Kit), Discord (Rich Embeds), and Microsoft Teams (Adaptive Cards 1.5+). Allows for deep integration into enterprise notification workflows.

Implemented exponential backoff with jitter and a smart Circuit Breaker mechanism to pause failing endpoints, ensuring appliance performance remains stable during external outages.

Added a one-click 'Test Payload' feature and real-time delivery history logs directly in the management UI for instant verification of external alert routing.

Features encryption-at-rest for URLs, masked secret management, and optional HMAC-SHA256 signing for cryptographically verified payload integrity.

Fixed a cross-platform encryption issue preventing database migration between Windows and Docker/Linux.

Hardened auto-detection to ignore 169.254.x.x subnets while keeping them manually selectable.

Retired the legacy power icon for a modern User Avatar system with integrated profile management and alert diagnostics.

Converted the scan engine to a push-model reactive system for instantaneous, millisecond-accurate progress feedback in the UI.

Standardized all settings layers to use high-performance atomic write patterns, eliminating I/O latency and disk corruption risks.

Optimized the discovery engine to support managed network hardware that prioritizes ICMP over ARP responses.

Reduced default discovery timeouts from 2s to 1s to ensure rapid failure detection on large subnets without impacting accuracy.

Complete refactor of the release history UI with real-time search, collapsible entries, and optimized filtering logic.

Unified industrial-grade icons across all historical release notes for consistent visual governance.

Full UI-driven control over HTTP/HTTPS ports with a graceful, persistent restart-and-migrate workflow. No command-line access required.

Replaced standard Swagger with a beautiful, high-performance Scalar UI at /api-docs. Securely gated behind Admin roles for internal development.

Upgraded self-signed certificate generation with modern .NET 10 APIs and 'Basic Constraints: CA=True' to satisfy strict browser trust requirements.

Built a robust PBKDF2 hashed token system for external API access, replacing the legacy static JWT model with individually revocable keys and usage auditing.

Updated commercial tier scaffolding (superseded: current model is Free portable + Business $40; see pricing on the home page).

Replaced manual fulfillment uploads with an automated Cloudflare R2 pipeline. All installers now support versioned permalinks.

Integrated native Windows MSI generation with industrial code signing into the global CI/CD pipeline.

New root-level automation script for 'One-Click' build, sign, distribute, and git-sync operations.

Implemented 'Neutral Skip' logic across all platforms (Windows, macOS, Linux/Docker) to prevent accidental public releases while keeping the CI dashboard green.

StacksAtlas can now be deployed natively on Apple Silicon/Intel Macs and any Linux server (Ubuntu, Synology, Unraid) via Docker!

Resolved the 'Ghost Ping' bug on Linux by pivoting to a native Nmap discovery backend, ensuring 100% accurate device counts in Docker.

Implemented GitHub Actions to automatically build and publish Docker images and native macOS binaries on every release.

Fixed startup race conditions; auto-detection now handles late network interface initialization gracefully.

Scanning now starts instantly after creating the initial admin account, no restart required.

Implemented immediate visual feedback for risk acknowledgement.

Added one-click launch support for SSH, Telnet, and FTP.

PDF/CSV reports now include Security Grades (A/C/F).

Added 'Hard Delete' option for complete removal.

Smart sorting for IP addresses in lists and reports.

Manual reset capability for device performance counters.

Fixed critical race conditions and deadlock prevention.

Modernized scrollbars and layout refinements.

Cutdown sweep time from 30s to 5s.

Integrated Nmap scanning for deep service discovery.

Correctly activated licenses now support 30-day offline grace period.

New progress bar UI provides live feedback during deep scans.

Installer now handles Nmap dependencies automatically.

Native detection for IP Cameras, NDI Video, and Storage Infrastructure.

Splash screen and lock contention resolution.

Automated global repair of legacy stability data.

Native fetching of web page titles for better ID.

Real-time identification of PTP Master clocks.

Added secure encrypted database migration export.

Enhanced classification for Dante, Q-SYS, Biamp, Shure, and Crestron.

Manual edits to Model or Vendor are protected from automated overwrites.

Specific icons for Microphones, Amplifiers, Mixers, and NAS.

Added capability to restart the host service/system from the UI.

Added Network Adapter selection and transparency.

Added Backup & Restore (Snapshot) functionality.

Ensuring secure and trusted deployments.

Industrial-grade network scanning and identification.

Weighted analytics for predicting hardware failure.

Professional PDF and CSV exports for inventory audits.