`stack upload` fails because Hackage has introduced CSRF protection checks but the Stack user-agent has not yet been whitelisted. See: * https://github.com/haskell/hackage-server/issues/1481 A work around, in the interim, is to use a Hackage API key. See: * https://docs.haskellstack.org/en/stable/configure/environment_variables/#hackage_key