LinkBreeze v1.0.1

What's New in 1.0.1

This release focuses on security hardening, community contributions, and developer experience. It is a PATCH release — no breaking changes, no new features, just fixes and improvements.

🔒 Security

• Session invalidation on password change — stolen/old cookies are now instantly invalid after a password change
• QR download rate limiting — 30 req/min per IP to prevent CPU abuse
• Link URL scheme validation — blocks javascript: and data: URI XSS (contributed by @MFA-G)
• Backup version validation — incompatible backups rejected before touching the database (contributed by @vku2018)
• Social icon URL detection hardened — proper hostname matching instead of .includes(), resolves 12 CodeQL alerts
• CI workflow least-privilege permissions — resolves 1 CodeQL alert
• Security docs overhaul — CSRF protection, vulnerability reporting timeline, safe harbor clause

🐛 Fixed

• Middleware HMAC session validation
• PowerShell compatibility for Docker commands
• docker-compose.yml now pulls pre-built image from GHCR by default
• 7 dependency bumps via Dependabot (next, react, tailwindcss, etc.)

📦 Added

• Dependabot config (weekly npm/Docker, monthly GitHub Actions)
• CI status badge in README
• robots.txt, sitemap.xml, LICENSE file
• TROUBLESHOOTING.md with upgrade guide and slug management docs

🤝 Community

First external contributors! Thank you:

• @MFA-G — URL scheme validation with tests (PR #29)
• @vku2018 — Backup version validation with tests (PR #30)

---

Full changelog: https://github.com/Manak-hash/LinkBreeze/blob/main/CHANGELOG.md