diff --git a/CHANGELOG.md b/CHANGELOG.md
index 247947f..34bcacd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,36 @@ for what changed inside the apps it composes.
 
 ## [Unreleased]
 
+## [1.8.0] - 2026-07-27
+
+### Bumped
+- sso-manager-node -> [v1.6.0](https://github.com/theta42/sso-manager-node/releases/tag/v1.6.0)
+- proxy -> [v1.5.0](https://github.com/theta42/proxy/releases/tag/v1.5.0)
+- jump-host -> [v1.6.0](https://github.com/theta42/jump-host/releases/tag/v1.6.0)
+
+All three apps adopt the newly published `@simpleworkjs/frontend` package's
+`app.messages`, `app.modal`, and `app.validate` modules, replacing the
+vendored `app.util.actionMessage`/`actionConfirm`/`alert` in
+`public/lib/js/app-base.js` (byte-identical across all three apps) and the
+vendored `public/lib/js/val.js` (byte-identical in sso-manager-node and
+jump-host, and the same engine plus proxy-only DNS/hostname rules in proxy).
+Message content is now HTML-escaped — the ad hoc `app.util.alert()` this
+replaces had none — and `app.messages.action` falls back to a page-wide
+toast when there's no inline `.actionMessage` target on the page. proxy's
+`host`/`target`/`hostname` wildcard-DNS validation rules (mirroring
+`utils/hostname_validate.js`) move to its own `public/js/app.js`, registered
+via `$.validateSettings`, since they're proxy-specific and don't belong in
+the shared package's generic rule set (`eq`/`user`/`password`/`ip`).
+jump-host doesn't currently use any `[validate]` attributes, so its `val.js`
+swap is dedup/future-proofing rather than a behavior change.
+
+`app.api`/`app.auth`/`app.pubsub`/`app.socket` in each app's `app-base.js`
+are untouched: they're app-specific (a dual-mode callback/promise API with
+`auth-token` header injection) and not something the frontend package's
+generic `app.js` provides, so it isn't loaded.
+
+No `setup.sh`, compose, or config change.
+
 ## [1.7.0] - 2026-07-27
 
 ### Bumped
diff --git a/jump-host b/jump-host
index fd863b8..4a70b5b 160000
--- a/jump-host
+++ b/jump-host
@@ -1 +1 @@
-Subproject commit fd863b89caedef9f8079dba5ce28e86acb5cc918
+Subproject commit 4a70b5b27e7c5e1e8616c0c5978ee8da1d94465f
diff --git a/proxy b/proxy
index 75045b4..3686a5d 160000
--- a/proxy
+++ b/proxy
@@ -1 +1 @@
-Subproject commit 75045b4b335a0a8619ad9d2061f5a13ea8765e1d
+Subproject commit 3686a5ddb8bfb7dae2e949553c38b317ce8fa601
diff --git a/sso-manager-node b/sso-manager-node
index 5665504..ffb2e99 160000
--- a/sso-manager-node
+++ b/sso-manager-node
@@ -1 +1 @@
-Subproject commit 5665504bc121bcce94abcf6bd29bb63b9ffa74e1
+Subproject commit ffb2e991993d6be3bf88b65fd9dc017bbb806fc0