fix(docker): drop inherited VOLUME /srv/www that caused silent stale deploys

VOLUME ["/srv/www"] created an anonymous volume that docker compose reuses across
container recreation, shadowing a freshly COPY'd SPA bundle with the previous build
— up -d --build exited 0 while serving the old bundle (and poisoned the PWA service
worker's ngsw.json). A child image cannot un-declare an inherited VOLUME, so it must
not be declared: removing it makes the COPY case deterministic and leaves the runtime
bind-mount case unaffected. Also refreshed the README FROM tag v1.0.0 -> v1.6.0.

CHANGELOG.md

@@ -6,6 +6,35 @@ This module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html
 
 ---
 
+## [1.6.0] — 2026-08-14
+
+Minor — coordinated framework release (lockstep versioning). No changes to this module's own API.
+
+### Fixed
+
+- **Dropped `VOLUME ["/srv/www"]` from the base image.** The declaration created an anonymous
+  volume at the SPA root that `docker compose up` reuses across container recreation, so a
+  rebuild silently kept serving the previous bundle (`up -d --build` exited 0 while shipping the
+  old build; on a PWA the stale `ngsw.json` then poisoned the service-worker cache). Consumers
+  could not un-declare an inherited `VOLUME` and were stuck with `--renew-anon-volumes` forever.
+  Removing it makes the headline `COPY dist/ /srv/www/` case deterministic, and the runtime
+  bind-mount case (`-v /path:/srv/www`) is unaffected. *The `v1.6.0` image was rebuilt and
+  re-pushed with this fix.* Consumers with an already-poisoned anonymous volume need a one-time
+  `-V` (or `docker volume rm`) to shed it.
+
+### Changed
+
+- Bumped einherjar dependencies to v1.6.0. The framework-wide change in this release is
+  `web`'s new `httputil.Bind` / `httputil.BindEmpty` request-binding adapters.
+
+## [1.5.0] — 2026-08-09
+
+Minor — coordinated framework version alignment. No code or API changes in this module.
+
+### Changed
+
+- Bumped `contracts`, `core` to v1.5.0.
+
 ## [1.4.0] — 2026-08-09
 
 Minor — coordinated framework release: dependency refresh + lockstep version alignment.

Dockerfile

@@ -25,7 +25,12 @@ LABEL org.opencontainers.image.base.name="alpine:3.21"
 LABEL org.opencontainers.image.base.digest="$BASE_DIGEST"
 LABEL dev.nochebuena.healthz="/health"
 
-# Mount your SPA dist/ here, or COPY it in a downstream Dockerfile.
+# Provide your SPA build at /srv/www — COPY dist/ in a downstream Dockerfile, or
-VOLUME ["/srv/www"]
+# bind-mount it at runtime (-v /path/to/dist:/srv/www). No VOLUME is declared here
+# on purpose: a VOLUME at this path creates an anonymous volume that `docker compose
+# up` reuses across container recreation, shadowing a freshly COPY'd bundle with the
+# previous build — a silent stale deploy (worse for PWAs, whose service worker then
+# caches the stale ngsw.json). A runtime bind-mount works with or without it, and a
+# child image cannot un-declare an inherited VOLUME, so it must not be declared at all.
 EXPOSE 8080
 ENTRYPOINT ["/app/spa-server"]

README.md

@@ -1,6 +1,6 @@
 # einherjar/spa-server
 
-[![version](https://img.shields.io/badge/version-v1.4.0-5C4EE5?style=flat-square)](https://code.nochebuena.dev/einherjar/spa-server)
+[![version](https://img.shields.io/badge/version-v1.6.0-5C4EE5?style=flat-square)](https://code.nochebuena.dev/einherjar/spa-server)
 [![license](https://img.shields.io/badge/license-AGPL--3.0-22863A?style=flat-square)](LICENSE)
 [![go](https://img.shields.io/badge/Go-1.26+-00ADD8?style=flat-square&logo=go&logoColor=white)](https://go.dev)
 
@@ -15,7 +15,7 @@ The module ships as a ready-to-use Docker base image. Deploying a SPA to a conta
 ## Container usage
 
 ```dockerfile
-FROM code.nochebuena.dev/einherjar/spa-server:v1.0.0
+FROM code.nochebuena.dev/einherjar/spa-server:v1.6.0
 COPY dist/ /srv/www/
 ```
 

go.mod

@@ -3,6 +3,6 @@ module code.nochebuena.dev/einherjar/spa-server
 go 1.26
 
 require (
-	code.nochebuena.dev/einherjar/contracts v1.4.0
+	code.nochebuena.dev/einherjar/contracts v1.6.0
-	code.nochebuena.dev/einherjar/core v1.4.0
+	code.nochebuena.dev/einherjar/core v1.6.0
 )

go.sum

@@ -1,4 +1,4 @@
-code.nochebuena.dev/einherjar/contracts v1.4.0 h1:rv/93dGXmXvO90G0uxCu8y3+5+EobkVvcoxh/BywIFk=
+code.nochebuena.dev/einherjar/contracts v1.6.0 h1:Y+8B+m4kQR5l/6lMY7SYdvIbwhFOnliCXDv9oBCOUP4=
-code.nochebuena.dev/einherjar/contracts v1.4.0/go.mod h1:ccltUtrFb5+MEJdkx2VVEUL+xC5pupVlVVsMM8AlCWI=
+code.nochebuena.dev/einherjar/contracts v1.6.0/go.mod h1:ccltUtrFb5+MEJdkx2VVEUL+xC5pupVlVVsMM8AlCWI=
-code.nochebuena.dev/einherjar/core v1.4.0 h1:YBRFzgeWNh8BCHueNYGo+V754BjzvJvq2CddJcc5ZjQ=
+code.nochebuena.dev/einherjar/core v1.6.0 h1:6cQIYZliw0hcuk7Cy44swleLC1Ch8WFxTkkHsGxkAFk=
-code.nochebuena.dev/einherjar/core v1.4.0/go.mod h1:dILfAATF++TBeLOwUTQsYci+Ft7yK5ivt00iRYctfGk=
+code.nochebuena.dev/einherjar/core v1.6.0/go.mod h1:azRKvJBtMWGp8jhveG1fZc9jlPTwXu8clvBdXIjTB9k=