Add missing CHANGELOG entry for 5.6.1

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: namedgraph

CHANGELOG.md

@@ -1,18 +1,28 @@
-## [Unreleased]
+## [5.6.1] - 2026-07-26
 ### Security
-- SSRF: `URLValidator` now blocks wildcard/any-local (0.0.0.0, ::) addresses in addition to link-local and private ranges, and checks every address the host resolves to (narrowing the DNS-rebinding window). Loopback stays reachable for same-origin document/WebID dereferencing; the backend triplestore is site-local (already blocked). `ALLOW_INTERNAL_URLS` remains the development escape hatch (LNK-003/LNK-009)
-- XXE: added `SecureXML` hardened parser factories — `XSLTMasterUpdater` parses with DTDs and external entities disabled, and the external responses parsed by `ldh:send-request` use secure processing (entity-expansion capped) with external entities disabled (LNK-005 residual)
+- SSRF: `URLValidator` blocks wildcard/any-local (`0.0.0.0`, `::`) addresses and checks every resolved address; loopback stays reachable, `ALLOW_INTERNAL_URLS` remains the escape hatch (LNK-003/LNK-009)
+- XXE: `SecureXML` hardened parser factories disable DTDs/external entities in `XSLTMasterUpdater` and `ldh:send-request` responses (LNK-005 residual)
 - Upgraded `java-jwt` 3.19.4 → 4.5.2 on the OAuth2/OIDC verification path
-- Documented the pinned-truststore invariant behind the disabled hostname verification on internal HTTP clients
+- Documented the pinned-truststore invariant behind disabled hostname verification on internal HTTP clients
 
 ### Added
-- Unit tests for `AuthorizationFilter`: the HTTP-method → ACL access-mode contract (`GET`/`HEAD`→Read, `POST`→Append, `PUT`/`DELETE`/`PATCH`→Write), mode lookup, and the owner Read/Write/Append grant
-- Loopback/wildcard `URLValidator` tests; JWKS-based `JWTVerifier` tests (valid, wrong issuer, wrong audience, expired, missing `kid`, bad signature)
-- `AGENTS.md`: an agent-facing guide to driving a running instance's HTTP API — data model, WebID auth, read/write discipline (writes via `POST`/`PUT`/`PATCH` on document URLs; read-only SPARQL), content model, dataspaces, tooling
-- Dependabot config (`.github/dependabot.yml`) for Maven, the Docker base image, and GitHub Actions updates; routine Maven minor/patch bumps grouped into one PR
+- Unit tests for `AuthorizationFilter`'s HTTP-method → ACL access-mode contract, mode lookup, and owner grant
+- Loopback/wildcard `URLValidator` tests; JWKS-based `JWTVerifier` tests
+- `AGENTS.md`: agent-facing guide to driving a running instance's HTTP API
+- Dependabot config (`.github/dependabot.yml`) for Maven, the Docker base image, and GitHub Actions
 
 ### Changed
-- Cache TTLs configurable: the WebID model cache and the JWKS cache now read their expiration (seconds) from `WEBID_CACHE_EXPIRATION` / `JWKS_CACHE_EXPIRATION` (default 86400 = 1 day), via `CATALINA_OPTS` system properties like the `CLIENT_*` timeouts. Lowering `WEBID_CACHE_EXPIRATION` bounds how long a revoked WebID stays authenticated
+- Cache TTLs configurable via `WEBID_CACHE_EXPIRATION` / `JWKS_CACHE_EXPIRATION` (default 86400s), bounding how long a revoked WebID stays authenticated
+- CSR label rendering consolidated on Web-Client per-vocab templates; retired `$ldt:lang` for `$ac:langs` from `navigator.languages`; added client-side `ac:uuid()` (#323)
+- Web-Client dependency bumped to 5.0.3
+
+### Fixed
+- View queries with a `FROM`/`FROM NAMED` clause returned `400`; `ldh:wrap-describe` now hoists the clause to the outer `DESCRIBE`
+- Duplicate bilingual widget headings when the browser language matched neither value (#323)
+- Language badge leaking into view headings (e.g. `enCurrent members`)
+- `acl:mode()` went stale on fetch-less tab-pane switches; flags now re-synced from the activated pane
+- Modal live-search debounce logged an unsupported-scheme fetch from `document="ixsl:page()"`
+- Left-sidebar flyout clipped on short viewports; now scrolls
 
 ## [5.6.0] - 2026-07-08
 ### Added