v0.10.2

Bahasa Indonesia

Pembaruan keamanan

• Next.js 16.3.8 → 16.4.2: menambal celah SSRF pada Image Optimization (GHSA-cjq9-62q9-8jv4).
• sharp 0.35.4 → 0.35.5: menambal celah pada librsvg yang dipakai untuk memproses gambar upload (GHSA-wq5f-xc86-pv6w).
• Dependency turunan (proxy-addr, source-map-js) ikut diperbarui. npm audit --omit=dev kini bersih.
• Image Docker dibangun di atas node:22-slim terbaru, yaitu Node.js 22.23.4, yang memuat perbaikan dari rilis keamanan Node.js 21 Oktober 2026 (termasuk celah Brotli dan verifikasi hostname TLS).

Cara update

docker compose pull && docker compose up -d

Migration database berjalan otomatis, tidak perlu langkah tambahan. Disarankan backup volume data sebelum update.

Catatan

Riwayat git dirapikan dan semua tag dipindahkan ke commit baru. Isi kode tidak berubah. Jika Anda punya clone atau fork lama, jalankan git fetch origin --tags --force && git reset --hard origin/main, atau clone ulang.

English

Security updates

• Next.js 16.3.8 → 16.4.2: fixes an SSRF vulnerability in Image Optimization (GHSA-cjq9-62q9-8jv4).
• sharp 0.35.4 → 0.35.5: fixes a vulnerability in librsvg, which processes uploaded images (GHSA-wq5f-xc86-pv6w).
• Transitive dependencies (proxy-addr, source-map-js) were updated as well. npm audit --omit=dev is now clean.
• The Docker image is built on the latest node:22-slim, i.e. Node.js 22.23.4, which includes the fixes from the October 21, 2026 Node.js security release (including the Brotli and TLS hostname verification issues).

How to update

docker compose pull && docker compose up -d

Database migrations run automatically, no extra steps needed. Backing up your data volume before updating is recommended.

Note

Git history was tidied and all tags were moved to new commits. The code itself is unchanged. If you have an old clone or fork, run git fetch origin --tags --force && git reset --hard origin/main, or clone again.

v0.10.1

Bahasa Indonesia

Perbaikan

• Background GIF sekarang bergerak (#27). Sebelumnya GIF yang dipakai sebagai background halaman tampil statis karena hanya frame pertama yang diproses. Sekarang GIF dikonversi ke WebP animasi, jadi animasinya tetap jalan. Berlaku untuk upload background di tab Theme dan import theme. Avatar, banner, thumbnail, dan image button tidak berubah (tetap WebP statis).
• Footer sekarang selalu di paling bawah halaman (#28). Sebelumnya footer menempel tepat di bawah link terakhir, jadi di halaman dengan link sedikit footer melayang di tengah layar.
• Upload file di atas 10MB tidak lagi gagal dengan error "Unexpected end of form". Batas buffer body request di proxy (default 10MB) dinaikkan menjadi 20MB, sama dengan batas Server Action. Ini yang bikin GIF background 11MB gagal di-upload.

Catatan

• Background yang sudah terlanjur diupload sebelum versi ini tetap statis. Upload ulang file GIF-nya untuk mendapat animasi.
• Kalau memakai reverse proxy (misalnya Nginx), pastikan batas upload-nya (client_max_body_size) cukup untuk file besar.

English

Fixes

• GIF backgrounds now animate (#27). Previously a GIF used as a page background was shown as a static image because only the first frame was processed. GIFs are now converted to animated WebP so the animation keeps playing. This applies to background uploads in the Theme tab and to theme imports. Avatars, banners, thumbnails, and image buttons are unchanged (still static WebP).
• The footer is now always pinned to the bottom of the page (#28). Previously it sat right under the last link, so on pages with few links it floated mid-screen.
• Uploads larger than 10MB no longer fail with "Unexpected end of form". The proxy's request body buffer limit (10MB by default) is raised to 20MB, matching the Server Action limit. This was what made an 11MB GIF background fail to upload.

Notes

• Backgrounds uploaded before this version stay static. Re-upload the GIF to get the animation.
• If you run behind a reverse proxy (e.g. Nginx), make sure its upload limit (client_max_body_size) allows large files.

v0.10.0

Bahasa Indonesia

Fitur baru

• Library Image Button — kumpulan gambar berlabel di Customize Theme > Image Buttons. Card style Image sekarang memilih gambar dari library; ganti gambar di library dan semua link yang memakainya ikut berubah. Bisa upload gambar atau bikin placeholder solid. Link Image lama dimigrasi otomatis.
• Export/import theme membawa gambar — file export sekarang ikut membawa image button yang dipilih, background, dan custom font. Format export lama tetap bisa diimport.
• Gaya khusus per link — satu link bisa menimpa sebagian gaya theme (tipografi, bentuk & permukaan, warna, hover & tata letak). Kelompok yang tidak dinyalakan tetap mengikuti theme. Ada preview langsung di dalam form (latar halaman dari theme, bisa dibandingkan dengan tampilan theme saja).
• Tombol Simpan gambar di card style Image: gambar baru langsung masuk library dan terpilih.

Perbaikan

• Validasi kepemilikan linkId/groupId terhadap page di semua aksi dashboard, persistBoard, dan social links; ID milik page lain diabaikan (#11).
• Form link tidak lagi ter-reset (file, URL, Card style) saat ada error validasi, dan pesan error sekarang tampil di atas tombol Simpan.

Catatan upgrade

• Rilis ini menambah dua migration database (otomatis berjalan saat container start). Disarankan backup database dulu.

Menutup #7, #11.

---

English

New features

• Image Button library — labeled images under Customize Theme > Image Buttons. The Image card style now picks from the library; replace an image there and every link using it updates. Upload an image or generate a solid placeholder. Existing Image links are migrated automatically.
• Theme export/import now carries images — exports include the selected image buttons, the background, and the custom font. The old export format is still accepted.
• Per-link style override — a single link can override parts of the theme (typography, shape & surface, colors, hover & layout). Groups left off keep following the theme. A live preview sits inside the form (page background from the theme, with a toggle to compare against the plain theme look).
• Save image button on the Image card style: a new image goes into the library and is selected right away.

Fixes

• linkId/groupId are now validated against the page in every dashboard action, persistBoard, and social links; IDs from other pages are ignored (#11).
• The link form no longer resets (file, URL, card style) on validation errors, and the error now shows above the Save button.

Upgrade notes

• This release adds two database migrations (applied automatically on container start). Back up the database first.

Closes #7, #11.

v0.9.2

Bahasa Indonesia

Keamanan

• Next.js dinaikkan ke 16.3.8 — menambal celah RCE kritis di next/og, plus perbaikan dari npm audit. Sangat disarankan semua pengguna update.
• Webhook, content feed, dan pengambilan gambar OG sekarang menolak alamat link-local (mis. endpoint metadata cloud 169.254.169.254) sehingga tidak bisa dipakai untuk SSRF. localhost/LAN tetap boleh, jadi webhook ke n8n / Home Assistant di mesin yang sama tetap jalan.
• Webhook tidak lagi mengikuti redirect.
• getSocialLinksForPage sekarang mewajibkan kepemilikan page.
• Ekstensi file yang diupload di link tipe file sekarang disanitasi (hanya alfanumerik maks. 8 karakter, selain itu jadi .bin).
• Ditambahkan Dependabot untuk npm dan GitHub Actions.

Perbaikan

• Scope discord:read dan discord:write akhirnya bisa dipilih saat membuat API token (#10).
• Map rate-limit sekarang punya batas ukuran (10.000 key) supaya tidak tumbuh tanpa batas (#12).

Lainnya

• Menghapus dependency zod yang tidak terpakai.

Menutup #10, #12, #14.

---

English

Security

• Bumped Next.js to 16.3.8 — patches a critical RCE in next/og, plus npm audit fixes. All users are strongly encouraged to update.
• Webhooks, content feeds, and OG image fetching now reject link-local addresses (e.g. the cloud metadata endpoint 169.254.169.254), preventing SSRF. localhost/LAN stays allowed, so webhooks to n8n / Home Assistant on the same machine keep working.
• Webhooks no longer follow redirects.
• getSocialLinksForPage now requires page ownership.
• Uploaded file extensions on file-type links are now sanitized (alphanumeric, max 8 chars, otherwise .bin).
• Added Dependabot for npm and GitHub Actions.

Fixes

• discord:read and discord:write scopes can now actually be selected when creating API tokens (#10).
• The rate-limit map now has a size cap (10,000 keys) so it can no longer grow unbounded (#12).

Other

• Removed the unused zod dependency.

Closes #10, #12, #14.

v0.9.1

🇮🇩 Bahasa Indonesia

Perbaikan

• Teks di atas gambar (card style Image). Sekarang judul link bisa ditampilkan menumpuk di atas gambar, dan kamu juga bisa menambahkan icon, emoji, atau gambar kecil di atasnya. Keduanya diatur lewat toggle terpisah di form link, jadi bisa dipakai sendiri-sendiri atau bareng. Posisinya mengikuti pengaturan align dan posisi icon dari theme. Terima kasih kepada @reddexx yang melaporkan ini (#6).

Catatan upgrade

• Ada migration database baru. Jalan otomatis saat container start, tidak perlu menjalankan apa pun secara manual.

---

🇬🇧 English

Fixes

• Text over images (Image card style). The link title can now be overlaid on top of the image, and you can also add an icon, emoji, or small image on top. Each is a separate toggle in the link form, so you can use either one or both. Placement follows the theme's alignment and icon position settings. Thanks to @reddexx for reporting this (#6).

Upgrade notes

• This release includes new database migrations. They run automatically when the container starts, so no manual steps are needed.

v0.9.0

Bahasa Indonesia

Fitur baru

• API key YouTube resmi (opsional) buat deteksi live -- lebih akurat dan gak kena blokir anti-bot YouTube (sering kejadian kalau server di VPS/datacenter). Ada tutorial cara bikin API key langsung di dashboard (tab Automation), lengkap sama tombol ke Google Cloud Console. Gratis, pemakaian kecil (~2.900 dari kuota 10.000/hari).
• Skrip diagnostik npm run yt:check buat troubleshoot deteksi live YouTube dari server mana pun.

Perbaikan

• Deteksi live YouTube (tanpa API key) sekarang parse data halaman secara utuh, bukan regex per-field -- sebelumnya bisa salah baca video/channel LAIN yang muncul di halaman sebagai status channel yang dicek.
• Kalau data halaman YouTube gak lengkap (kena blokir dari IP tertentu), status live dibiarin apa adanya (gak dipaksa jadi false), jadi badge yang beneran live gak mendadak mati sendiri.
• Ditambah pengecekan ulang sebelum nyalain badge/nampilin grup -- baca yang salah 1x gak langsung dianggap final.

Catatan

• Versi 0.8.1 kemarin ke-tag tapi package.json-nya kelupaan di-bump (halaman About masih nunjukin 0.8.0) -- udah dibenerin di rilis ini.

Auto-update note: kalau kamu belum pernah isi API key YouTube, gak ada yang perlu diubah -- fitur lama (scraping) tetap jalan sebagai default.

---

English

New features

• Official YouTube API key (optional) for live detection -- more accurate and not affected by YouTube's anti-bot blocking (common when the server runs on a VPS/datacenter). A step-by-step tutorial for getting the key is built into the dashboard (Automation tab), with a direct link to Google Cloud Console. Free, low usage (~2,900 of the 10,000 daily quota).
• npm run yt:check diagnostic script to troubleshoot YouTube live detection from any server.

Fixes

• YouTube live detection (without an API key) now parses the whole page data object instead of per-field regex -- previously it could misread another video/channel shown on the page as the checked channel's status.
• When the YouTube page data is incomplete (blocked from certain IPs), live status is now left alone instead of being forced to false, so a badge that's genuinely live no longer turns off on its own.
• Added a re-check before turning on the badge or revealing a group -- one bad read no longer counts as final.

Note

• v0.8.1 was tagged earlier but package.json wasn't actually bumped (the About page still showed 0.8.0) -- fixed in this release.

Auto-update note: if you haven't set a YouTube API key, nothing changes -- the old scraping-based detection still works as the default.

v0.8.0

Bahasa Indonesia

Perbaikan

• Deteksi YouTube Live sekarang gak lagi salah baca stream yang masih scheduled/upcoming sebagai sedang live.
• Perbaikan ukuran avatar di preview Discord Widget.

Fitur baru

• Background partikel baru: gravity dust, blackhole, color morph, firefly.
• Redesign gallery preset/theme dengan live preview + filter kategori.
• Link button berbasis gambar (displayStyle "image").
• Discord Widget: bisa atur lebar/tinggi custom + toggle aktif/nonaktif.

Lainnya

• Optimasi build (batasi worker & heap V8) biar gak makan RAM berlebih di VPS kecil.

Closes #3, #4, #5

---

English

Fixes

• YouTube Live detection no longer misreads a scheduled/upcoming stream as currently live.
• Fixed avatar sizing in the Discord Widget preview.

New features

• New particle backgrounds: gravity dust, blackhole, color morph, firefly.
• Redesigned preset/theme gallery with live previews and category filters.
• Image-based link buttons (displayStyle "image").
• Discord Widget: configurable width/height + enable/disable toggle.

Other

• Build memory optimizations (capped worker count & V8 heap) to avoid overloading small VPS instances.

Closes #3, #4, #5

v0.7.1

Bahasa Indonesia

Perbaikan: Login langsung balik ke logout kalau di-deploy TANPA reverse proxy (akses langsung IP:port, HTTP biasa). Cookie session sebelumnya ditandai "Secure" berdasarkan mode environment, bukan koneksi asli, jadi diam-diam dibuang browser di HTTP biasa. (Menyelesaikan #2)

English

Fix: Login would immediately bounce back to logged-out when deployed WITHOUT a reverse proxy (plain IP:port access over HTTP). The session cookie was marked "Secure" based on the environment mode instead of the actual connection, so browsers silently dropped it on plain HTTP. (Resolves #2)

v0.7.0

Bahasa Indonesia

Fitur baru: Widget Server Discord (menyelesaikan permintaan fitur #1)

• Tampilkan nama server, jumlah member online, avatar, voice channel aktif, dan tombol join — data live dari Discord, tanpa perlu bot.
• Bisa bikin banyak widget sekaligus per halaman.
• Dua mode penempatan: Floating (nempel di salah satu dari 6 posisi layar, khusus desktop) atau Lewat link (taruh di mana aja lewat Link & Groups, termasuk di dalam grup tertentu).
• 4 gaya tampilan: Page Theme (ikut tema halaman kamu), Ala Discord, Ala Classic, dan Discord Embed (iframe resmi Discord).
• Live preview lengkap dengan visual position picker pas ngatur widget di dashboard.

English

New feature: Discord Server Widget (resolves feature request #1)

• Show server name, online member count, avatars, active voice channels, and a join button — live data straight from Discord, no bot required.
• Create multiple widgets per page.
• Two placement modes: Floating (pinned to one of 6 screen positions, desktop only) or Via link (place it anywhere through Links & Groups, including inside a specific group).
• 4 visual styles: Page Theme (matches your page's theme), Discord Style, Classic Style, and Discord Embed (Discord's official iframe).
• Full live preview with a visual position picker while configuring the widget in the dashboard.

v0.6.1

Bahasa Indonesia

Diperbaiki

• Deteksi YouTube Live (dipakai fitur Live Badge & Auto Show group) sekarang lebih tahan banting -- sebelumnya bisa salah kebaca "offline" padahal channel-nya beneran live, kalau halaman YouTube-nya ngerender tag canonical yang rusak (href="undefined"), tergantung IP/kondisi request. Sekarang sinyal isLive dicek duluan (sumber kebenaran yang sebenarnya), URL video-nya ada fallback ekstraksi langsung dari HTML kalau canonical-nya gak valid.

English

Fixed

• YouTube Live detection (used by the Live Badge & Auto Show group features) is now more resilient -- it could previously misreport "offline" even while a channel was genuinely live, if YouTube's page rendered a broken canonical tag (href="undefined"), depending on the requesting IP/conditions. The isLive signal (the actual source of truth) is now checked first, with a fallback that extracts the video URL directly from the page HTML when the canonical tag isn't valid.