Skip to content

LinkBreeze v1.0.2

Choose a tag to compare

View all tags
@Manak-hash Manak-hash released this 04 Jul 17:50
v1.0.2
f92b126

Security

  • SVG upload XSS eliminated — Removed .svg from the upload allowlist entirely. Added Content-Security-Policy: default-src 'none' and X-Content-Type-Options: nosniff headers to the uploads serving route. Closes #15.
  • Login rate limiting — 5 attempts/min per IP. Closes #1.
  • Production secret key warning — Console warning when SECRET_KEY unset in production + secretKeySet flag in health endpoint. Closes #9.
  • Backup row validation — Zod schemas validate every row before DB transaction.
  • Analytics foreign key — analytics_clicks.link_id now has FK with ON DELETE CASCADE.

Added

  • Comprehensive test suite — 134 tests across 16 files. Closes #6, #17.

Fixed

  • Login sidebar bug — /login redirects authenticated users to /dashboard.
  • Health endpoint version — Reads dynamically from package.json.

Changed

  • Atomic transactions for reorderLinks, clearAnalytics, setActiveTheme
  • Proactive rate-limit cleanup every 30s
  • Shared analytics-range module (deduplicated sinceExpr/parseRange)
  • npm overrides for postcss + esbuild — 0 vulnerabilities
  • CI workflow runs Vitest, Docker release workflow on tag push

Full Changelog: v1.0.1...v1.0.2

Assets 2
Loading