v0.5.1 - BLYSIS_AUTOMATED_BACKUP in .env can fix the automated backup on or off, and follow-redirects moves past a high advisory

Added

• BLYSIS_AUTOMATED_BACKUP in .env fixes the automated database backup on or off on the server, the way BLYSIS_UPDATE_CHANNEL fixes the update channel. Admin > Backups then shows the switch locked with the reason, and the API refuses to change it. Cadence and retention stay the screen's. Any other value is ignored, so a typo leaves the backup on. (#112)

Security

• follow-redirects 1.16.2 for GHSA-mrwp-f3q8-3g9p (high), reached through swagger-ui-react. (#111)

v0.5.0 - Themes lay out every page, three new themes ship, and the site's words and languages are the operator's to choose

Update with blysis update, or from Admin > Updates. A site pinned to a tag stays on it until you name the new one: blysis update 0.5.0. Then update your modules from Admin > Modules: thirty-five of them have a new version. The themes come with the update itself. If you run the public image directly, pull ghcr.io/inovixi/blysis:0.5.0.

This release also closes an information leak and caps what every visitor is sent, both under Fixed for security.

What you will notice after updating

• Your site opens in the language you chose at setup. Setup asked for it and nothing read the answer, so every site opened in English. A site set up in Turkish now opens in Turkish. Admin > Languages changes it, and chooses which languages visitors may pick.
• A footer you never arranged is grouped. Its links are drawn in a column per section the modules name (game, community, help) instead of one long column. A footer you arranged in Admin > Settings > Footer stays as you left it.

Themes lay out every page

A theme now decides where things go, not only how they look: the homepage's rows and columns, and the shop, a product, an article, a forum topic, a member's profile and the missing page. Admin > Settings > Widgets still switches any section off, whichever theme placed it. A theme can also bring its own typefaces, pictures, footer and the words of a page's heading, in every language.

Three new themes ship with it:

• Quarry: flat panels, buttons that press down and a landscape behind the hero.
• Vanguard: the navigation down the left edge, on a night stage of blocky hills.
• Kite: the site as a day in the sky, from morning to night.

Switch in Admin > Settings > Theme. Flat looks as it did.

Your site's words

Admin > Translations shows each string once, with what visitors read in every language and who says it.

• Every change has a history, and Undo puts back what a string said.
• Replace a word changes it in every string at once, after showing each change.
• After an update, Only what an update changed finds your edits whose original moved, and Only what awaits translation finds strings another language has moved past.
• Export and Import move your words to another site, with a preview of every change.

Live values

A module can offer a live value that your text may show. Servers offers players online and how many fit: write {servers.online} players online in a theme's headline, its numbers or your own words, and visitors read the count. Insert placeholder under the text lists what your site offers.

Fixed for security

• A member's profile listed and counted forum topics a visitor could not open: ones in a staff-only section, ones still awaiting approval, and every topic of a forum closed to visitors. It now shows only what that visitor could read. The fix is in the Member Profiles and Forum modules.
• Settings that every visitor receives had no size limit of their own, so an admin account could make every visitor's page carry a large answer. Each has one now.

Other changes

• Searching for "altin" or "ALTIN" finds "Altın", on the search page and in every list.
• A page stands still while it loads: the news and Vanguard's hero no longer move under the reader, and a menu on a taller bar stays open on the way into it.
• The activity feed and warnings speak the reader's language, and visitor pages name the site rather than the platform.
• Discord's widget follows the site's light or dark mode.
• A failure on the server is logged with the request that caused it.
• An operator's guide to languages and the site's words is in docs/user/languages-and-words.md.

v0.4.8 - Next.js 16.4.3 for two remote code execution advisories and a denial of service

A security release. Every site on 0.4.7 or earlier runs a Next.js with two unauthenticated remote code execution advisories and should update now: blysis update, or Admin > Updates. A site pinned to a tag with blysis update <tag> stays on it until you name the new one: blysis update 0.4.8. Nothing to do afterwards. If you run the public image directly, pull ghcr.io/inovixi/blysis:0.4.8.

Next.js 16.4.3

Three advisories published on 2026-10-22 cover next 16.0.0 to 16.4.0 and are fixed from 16.4.1. 0.4.7 shipped 16.4.0; 0.4.8 ships 16.4.3.

• GHSA-2464-fhr4-w9xw (critical): remote code execution without authentication in the Image Optimization API through SVG files. Blysis allows SVG through the image optimiser, so a stock installation is exposed.
• GHSA-673q-mjm6-r5xr (critical): remote code execution without authentication in use cache functions that return typed arrays. Neither core nor any module shipped with Blysis uses use cache; a module from elsewhere may.
• GHSA-p3m5-59mp-jv5r (CVE-2026-94482, high): denial of service in the App Router through Server Actions.

The dependency floor is now ^16.4.3, so no install can resolve an affected version.

Also fixed for security

• DOMPurify 3.4.17, past GHSA-cg2g-xh64-v4q7 (critical) and two related sanitiser bypasses (GHSA-mrv2-3pqr-j5jr, GHSA-c6gr-qvv4-5v3f). It cleans everything a person writes on the site.
• The module status list answered anyone who sent an x-internal-request header while INTERNAL_API_SECRET was unset, which is how every install starts. It no longer does.
• A username belongs to one person however it is capitalised, so nobody can register "Admin" beside "admin". Sign-in, password reset, store gifts and Minecraft linking match names the same way.
• A payment settles against what the store charged: one for less, or in another currency, is refused and logged, so an edited CoinPayments link can no longer pay a fifty for a cent. A credit top-up credits on every gateway, and shops in yen are charged the price on the page through Stripe and Mollie. These fixes are in the Store and gateway modules.

Backups on Docker

The image never created its backups directory, so on a Docker install no backup was ever written and an update from the panel refused to start unless the box that skips the backup was ticked. 0.4.8 repairs the volume's owner when it starts. If Admin > Updates will not start the update from 0.4.7, run blysis update on the server, or tick the box once; later updates take their backup again.

Other changes

• A site can follow betas and release candidates, chosen on the update screen.
• The update screen offers the releases that shipped.
• A menu on the bar stays open while the pointer moves into it, and chosen radios and checkboxes look chosen in dark mode.

Update the modules the marketplace marks as updated after the core update: Store, Blog, Minecraft Link, Steam Auth and the Stripe, PayPal, Mollie, CoinPayments, Paymentwall and PayTR gateways.

Image

ghcr.io/inovixi/blysis:0.4.8, also tagged 0.4, 0, v0.4.8 and latest.

v0.4.7 - game servers connect to the site

Game servers connect to the site, the site speaks ten more languages, and the panel and the site keep their own light or dark mode. Upgrade with blysis update, then update the Store module and install Game Connect from the marketplace. For Minecraft, take Blysis Connect 0.0.2 for Paper, Folia and Velocity.

Game Connect

A new module that connects game servers to the site. The game server opens every connection itself: it says hello with a token made on the site, polls for work, reports what it ran and pushes who is online. Nothing listens on the game server, no RCON port or password is needed, and the database never leaves the site. module-sources/game-connect/PROTOCOL.md is the whole contract.

• Deliveries: a purchase, a chest claim or an admin action becomes jobs for the right server, run when the player is online if the product says so. Leases, review on a lost answer, and nothing delivered twice.
• The store in game: shelves and products marked visible in game, paid in credits, with the product's questions, and gifts that wait for the recipient and can be taken back with a refund.
• Credits in game: balance, transfers, staff changes, rankings and the community goal; vouchers that pay once.
• Account linking both ways, from the game or from the site's /link page.
• Admin screens for connected servers, the delivery queue, vouchers and linked accounts.

Found in live testing

Every item below was proven on a running server before it was fixed.

• Money: a purchase hook that timed out could charge twice, and a credit change that timed out could lose the money. A filter listener that works on the caller's transaction is now waited for, and a purchase holds one lock per game key.
• Limits: ten purchases of a one-per-account product sent at once let four through; the limit is counted again inside the purchase. A gift can no longer get around a per-person limit.
• Amounts: one cent amount in nine below a hundred was refused because of a floating-point step.
• The in-game price is the one the site takes, with upgrade credit and bulk discounts, through a new quote route.
• Staff on a game server's console can change credits and mint vouchers.
• The name a delivery goes to is checked, and the link page names the game properly.

Theme and languages

• Azerbaijani, German, Spanish, Estonian, French, Italian, Polish, Brazilian Portuguese, Russian and Simplified Chinese join Turkish and English, across the core, every module and the emails.
• The panel keeps its own light or dark mode instead of changing the site's, and the theme page's mode buttons set the site's default.

Store admin

• The product editor puts its long sections (when it is for sale, in game, delivery commands, custom variables) in the wide column instead of a long narrow one.
• The delivery commands hint no longer says RCON, in every language, and sits under its title like the other cards.

v0.4.6 - the navigation stays on one row

The navigation bar stays on one row in every language, a search box keeps the first keystroke typed into it, and Next.js moves to 16.4.0. Upgrade with blysis update; no module needs updating.

The navigation wrapped on the Turkish site

The bar keeps its first eight links and folds the rest under "More". That count knows nothing about how long the words are: in Turkish the eight links and the fold measure about 1000px, so below 1536px the row wrapped inside a header whose height is fixed. On most laptop screens the first row rode up into the announcement bar and the second hung below the header, over the page. English held until 1280px.

The bar is now one line tall at every width. Whatever does not fit goes behind a trailing "More", so every destination stays one click away, and the entries it holds are taken out of the tab order while they are hidden. Nothing already on the line moves when this happens, and dropdowns are no longer clipped by the bar.

A search box could drop the first keystroke

A list whose search box mounted together with freshly fetched rows could reset the box after the first keystroke, leaving it empty with no search sent. The box now keeps what was typed.

Dependencies

• Next.js 16.4.0, from 16.3.6.
• Twenty routine updates, among them stripe 23, next-intl 4.14.9, nodemailer 10.0.15, redis 6.3.0 and pg 8.23.1.

v0.4.5 - the install lock works behind PgBouncer

The module install lock now works behind PgBouncer in transaction mode, and sharp moves to 0.35.5. Upgrade with blysis update; no module needs updating.

The install lock could outlive the install

A module install holds a Postgres advisory lock so a second process cannot start one at the same time. It was a session lock, taken and released by two separate statements. Against Postgres directly those run on the same session. Behind a pooler in transaction mode, such as PgBouncer, each statement can run on a different server connection, so the release could miss the connection holding the lock. Every later install was then refused as "already running" until that connection closed.

The lock is now taken inside a transaction that stays open for the install, and releasing it ends that transaction, so the lock goes with it on whichever connection holds it. A connection whose transaction cannot be ended is closed rather than reused.

Security

• sharp 0.35.5 closes GHSA-wq5f-xc86-pv6w (CVE-2026-96889) in the librsvg it bundles.

v0.4.4 - a rebuild that fails leaves the site up

A rebuild can no longer take the site down, and every module builds without
the modules it merely listens to. Upgrade with blysis update, then update
Credits, Currency, Forum, Minecraft link, Store and
Vote from Admin > Modules.

A failed rebuild left no site

Blysis rebuilds itself in place after a module install, and at boot when the
build and the installed modules disagree. Both ran next build into the live
.next, and next build starts by emptying it:

• During every install-time build the server kept rendering pages that
  name chunks that were already gone. Visitors got pages with no scripts or
  styles: /_next/static/chunks/... answered 404 with HTML.
• A build that failed left no build at all. The next start stopped at
  "BUILD_ID is missing" and stayed down. One module that did not type-check
  took the whole site with it.

A rebuild is now staged: it is written beside the live build, which the
site keeps serving untouched, and only a finished build replaces it - at the
next start, before the server reads .next. A failed build is thrown away and
the site goes on exactly as it was, admin panel included, so the module can be
removed. A replacement cut off by a crash is finished or rolled back on the
next start. A boot with no build at all is now rebuilt rather than refused.

Running outside Docker: start through npm start, not next start. Its new
prestart puts an install's build live; systemd and pm2 bring the process back
that way.

The install-time build's limit goes from 5 to 45 minutes - a full module set
outgrew five on a small machine, and a killed build was a lost one - and its
output buffer from 1 MB, which a chatty build could exceed and be killed for,
to 64 MB.

Modules that did not build without another module

A hook's types are declared by the module that emits it. Nine listeners leaned
on those types, so the site's build failed with TypeScript errors whenever the
emitting module was not installed:

Installed	Without	Fixed in
Forum, Store, Vote	Leaderboard	Forum 1.12.1, Store 2.46.3, Vote 1.6.3
Store	CSV import/export, Comparison table	Store 2.46.3
Credits, Currency	Store	Credits 1.9.1, Currency 1.6.1
Minecraft link	Member profiles	Minecraft link 1.6.1

Each listener now states the shape it reads; with both modules installed,
typecheck:modules still holds it against the declared contract. Every module
set was checked: all ninety together, and ninety minus each of the 29 modules
others listen to. A new test fails on a listener that leans on a declaration
neither core, its own module nor one of its dependencies provides.

Also

• Store 2.46.2 - migration 018_a_bulk_discount_covers_a_shelf failed a
  fresh install (42703 "productId" does not exist). It only surfaced once
  0.4.3 fixed 014 ahead of it. All 52 migrations of all ninety modules now run
  clean on a fresh database.
• demo:reset brings the Prisma client and the module registries in line
  with the installed modules before seeding, so a reset run in a container of
  its own (a Kubernetes CronJob, docker compose run) seeds cross-module data
  too - the comparison table now compares a real shelf.
• source-map-js 1.2.2 for GHSA-68fv-2mgg-jv7q (high), reached through
  postcss.

v0.4.3 - three migrations a fresh install could not get past

Three module migrations that failed every fresh install of their module.
Upgrade if you install modules: blysis update, then update Member
profiles, Store and Tickets from Admin > Modules.

What failed

Each of these is correct for the older database it was written for. On a new
one the reconcile has already created the final shape before migrations run,
and each tripped over that shape:

Module	Migration	Error
Member profiles 1.7.0	001_a_linked_game_account_names_no_game	42P01 "LinkedAccount" does not exist: 002 drops that table and the schema never declares it
Store 2.46.0	014_an_order_has_a_number_an_integrator_can_hold	42P07 "Order_number_key" already exists: the guard looked only for a constraint, while Prisma's @unique creates a unique index by that name
Tickets 1.8.0	002_a_ticket_state_is_a_row	2BP01 cannot drop type "TicketStatus": on a fresh install that is the row type of the TicketStatus table

The install itself went through and the tables were right, because the
reconcile built them, but the migrations stayed unrecorded and failed again on
every later install and every bootstrap.

The fix

Each migration now guards on what is actually there, and was run against both
the old and the fresh schema, twice each. Member profiles 1.7.1, Store 2.46.1
and Tickets 1.8.1 carry them.

An applied migration still may not change on disk. A fixed file names the
checksum of the text it replaces on a -- supersedes-checksum: line, and the
runner skips it for an install that already ran that text instead of aborting
the module. Only a checksum written there is accepted.

Image

ghcr.io/inovixi/blysis:0.4.3, also tagged 0.4, 0 and latest.

v0.4.2 - the demo puts itself back

A fix for public demos. Nothing changes for a regular installation.

demo:reset works under the published image

The image sets NODE_ENV=production, and seed-demo refuses a production
database unless it is passed --force. demo:reset did not pass it, so on a
demo host running the image every hourly reset stopped at its first step and
the demo was never put back.

demo:reset already refuses to run unless DEMO_MODE=1, which is the second
confirmation seed-demo asks for, so both of its seed-demo steps now pass
--force. Running seed-demo by hand against a production database still
needs the flag.

Image

ghcr.io/inovixi/blysis:0.4.2, also tagged 0.4, 0 and latest.

v0.4.1 - Next.js 16.3.6 for the next/og advisory

A security release. Upgrade if you run 0.4.0 or earlier: blysis update,
and nothing to do afterwards.

Next.js 16.3.6

GHSA-vcvr-r3jv-pc5j
(CVE-2026-94545, critical) covers next from 16.2.0 up to but not including
16.3.6. The Node ImageResponse from next/og can execute code when a value
from a request reaches SVG content, attributes or styles while an image is
generated. 0.4.0 shipped 16.3.4.

Neither core nor any module shipped with Blysis imports next/og, so a stock
installation did not expose the vulnerable path. A module you installed from
elsewhere may, and the dependency floor is now ^16.3.6, so no install can
resolve an affected version.

Also updated

The dependency updates that were waiting within their declared ranges,
including next-intl 4.14.6, zod 4.6.5, resend 6.28.1, marked 18.0.14,
isomorphic-dompurify 4.3.0, lucide-react 1.47.0 and the AWS S3 client.
No behaviour change.

Image

ghcr.io/inovixi/blysis:0.4.1, also tagged 0.4, 0 and latest.